Privacy Policy

Last updated: May 2026

1. Who We Are

Tracey Fretwell Lash Artistry is a sole-trader beauty business based in Soham, Cambridgeshire, UK. Tracey Fretwell is the data controller responsible for your personal information.

If you have any questions about this policy or how your data is handled, please get in touch via Instagram (@traceyfretwell_lashartistry) or Facebook (Tracey Fretwell Lash Artistry).

2. What Information We Collect

When you book an appointment or interact with this website, we may collect:

  • Contact details — your name, email address, and phone number
  • Booking details — the service you book, the date and time of your appointment, and any notes or preferences you provide
  • Payment information — whether you have paid and by which method (cash or card). If you pay by card, a reference to your saved payment method is stored so we can collect payment 48 hours before your appointment. We do not store your full card number, expiry date, or security code on this website — all payment card data is held securely by our payment provider, Stripe (see section 5 below)
  • Communications — messages you send us regarding your booking or aftercare queries
  • Basic technical data — your IP address and browser type, collected automatically when you visit this website

3. How We Use Your Information

We use your personal information to:

  • Process and manage your appointment bookings
  • Send you booking confirmations, reminders, and cancellation notices by email
  • Collect payment for appointments and enforce our cancellation policy
  • Respond to your enquiries and provide aftercare advice
  • Maintain records of appointments for our own business administration
  • Meet any legal obligations that apply to us

We will not use your personal information for marketing without your explicit consent.

4. Legal Basis for Processing

Under UK GDPR, we process your personal data on the following bases:

  • Contract — processing your booking, taking payment, and providing the agreed service
  • Legitimate interests — sending appointment reminders and enforcing our late-cancellation policy, in a way that does not override your rights
  • Legal obligation — retaining financial and appointment records where required by law (for example, for tax purposes)

5. Third Parties We Share Data With

We use a small number of trusted third-party services to run our business:

  • Stripe (stripe.com) — our payment processor. When you choose to pay by card, your payment card details are entered directly into a secure form provided by Stripe and are transmitted to and stored solely on Stripe's servers. Stripe is certified to PCI DSS Level 1, the highest level of payment security. We receive only a token reference to your saved payment method — your full card number and security code are never seen or stored by this website. Stripe may process data outside the UK; their practices are described in the Stripe Privacy Policy.
  • Google — we use Google Calendar to manage our appointment schedule; booking details may be synced to Google's servers for internal scheduling purposes only
  • Email provider — confirmation and reminder emails are sent via our transactional email service

We do not sell, rent, or trade your personal information to any third party for their own marketing purposes.

6. How Long We Keep Your Data

We retain appointment and contact records for up to 3 years after your last appointment. This allows us to maintain continuity of care (for example, knowing your lash history) and to comply with basic business record-keeping obligations. After this period, your data is securely deleted.

Payment records (including Stripe transaction references) are retained for up to 7 years to comply with financial record-keeping requirements.

7. Your Rights

Under UK GDPR you have the right to:

  • Access — request a copy of the personal data we hold about you
  • Rectification — ask us to correct inaccurate or incomplete information
  • Erasure — ask us to delete your data, subject to any legal obligations we have to retain it
  • Restriction — ask us to limit how we use your data while a dispute is resolved
  • Objection — object to processing based on legitimate interests
  • Portability — receive your data in a structured, commonly used format

To exercise any of these rights, please contact us via the social links above. We will respond within 30 days.

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

8. Cookies

This website uses a small number of essential cookies necessary for it to function (for example, to remember your session if you log in to manage a booking). We do not use advertising or tracking cookies, and we do not use third-party analytics services.

9. External Links

This website contains links to external sites (such as Stripe, Instagram, and Facebook). We are not responsible for the privacy practices of those sites and encourage you to read their own privacy policies.

10. Changes to This Policy

We may update this policy from time to time. The date at the top of this page reflects when it was last revised. Continued use of our services after any changes constitutes acceptance of the updated policy.