Privacy Policy

1. Who we are

This Privacy Policy explains how Aga Happy Feet, operated by Agata Cekliniak, collects, uses, stores and protects personal information.

For the purposes of UK data protection law, Agata Cekliniak trading as Aga Happy Feet is the data controller responsible for your personal information.

Contact details:

Aga Happy Feet
Agata Cekliniak
12a Castle Street
Reading
RG1 7RD
United Kingdom

Email: agacekbeauty@gmail.com
Telephone: +44 7476 407770
Website: agahappyfeet.co.uk

This Privacy Policy applies to personal information collected through our website, contact forms, telephone calls, emails, social media pages, booking systems and during consultations and treatments.

2. The personal information we collect

Depending on how you interact with us, we may collect the following categories of personal information:

Contact and identification information

This may include:

• your name;
• email address;
• telephone number;
• home or correspondence address;
• date of birth or age, where relevant;
• parent or guardian details where the client is under 18.

Appointment and service information

This may include:

• the treatment or service you are interested in;
• appointment dates and times;
• booking history;
• appointment reminders;
• cancellations and rescheduling information;
• communications relating to your appointment;
• preferences and information necessary to provide the requested service.

Health and treatment information

Some foot care and beauty treatments may require us to collect information relating to your health. This may include:

• medical conditions;
• allergies;
• medication;
• diabetes or circulatory conditions;
• pregnancy;
• skin, nail or foot conditions;
• infections, injuries or previous treatments;
• contraindications to a treatment;
• treatment notes and aftercare information;
• photographs of the treatment area, where necessary and agreed;
• information provided during a consultation.

Health information is considered special category personal data and is given additional protection.

Payment and transaction information

This may include:

• payment status;
• deposit information;
• transaction references;
• invoices and receipts;
• information relating to cancellations and refunds.

We do not normally store complete payment card details. Card payments may be processed by an independent payment or booking provider under its own privacy terms.

Website and technical information

When you visit our website, we or our service providers may collect:

• IP address;
• browser type and version;
• device type;
• operating system;
• approximate location based on the IP address;
• pages visited;
• date and time of access;
• referring website;
• website security and diagnostic logs;
• cookie preferences.

Marketing, photographs and testimonials

Where you have given permission, we may collect and use:

• marketing preferences;
• reviews or testimonials;
• photographs or videos;
• before-and-after treatment images;
• social media usernames or public interactions.

Separate permission will be requested before identifiable photographs, videos or testimonials are used for advertising, social media or website publication.

3. How we collect your information

We may obtain personal information:

• directly from you when you contact us;
• when you complete a contact, booking, consultation or consent form;
• during a telephone call, email exchange or social media conversation;
• during a consultation or treatment;
• from a parent, guardian or person booking on your behalf;
• through an online booking or payment platform;
• automatically through cookies, website logs and security technologies;
• from social media platforms when you interact with our public profiles.

Please ensure that any information you provide is accurate and that you inform us when it changes.

4. Why we use your information and our lawful bases

We only process personal information where we have a lawful reason to do so.

Responding to enquiries

We use your contact details and the contents of your message to answer questions, provide information about treatments and discuss possible appointments.

Our lawful basis is taking steps at your request before entering into a contract and, where appropriate, our legitimate interest in responding to enquiries about our services.

Managing appointments

We use your information to:

• arrange and confirm appointments;
• send service-related reminders;
• manage deposits;
• reschedule or cancel appointments;
• contact you about changes to an appointment.

Our lawful basis is the performance of a contract or taking steps before entering into a contract.

Providing treatments and maintaining client records

We use your personal information to:

• assess whether a treatment is suitable;
• identify contraindications and safety concerns;
• provide the requested treatment;
• document the treatment provided;
• give appropriate aftercare advice;
• monitor treatment progress;
• manage follow-up appointments;
• respond to questions or complaints.

Our lawful basis under Article 6 of the UK GDPR is normally the performance of a contract.

Where health information is required, we will also rely on an appropriate condition under Article 9 of the UK GDPR. Depending on the circumstances, this may include your explicit consent, the provision of health-related treatment by a person subject to appropriate confidentiality obligations, vital interests, or the establishment, exercise or defence of legal claims.

Where explicit consent is required, we will ask for it clearly. You may withdraw consent, although this will not affect processing that took place before withdrawal. In some circumstances, withdrawing consent may mean that we cannot safely provide or continue a particular treatment.

Payments, accounting and administration

We use transaction and payment information to:

• collect deposits and treatment fees;
• issue receipts and invoices;
• maintain accounting records;
• manage refunds;
• comply with tax and financial record-keeping obligations.

Our lawful bases are the performance of a contract and compliance with legal obligations.

Safety, insurance and legal claims

We may use personal and treatment information to:

• investigate incidents or complaints;
• maintain appropriate insurance records;
• establish what treatment was provided;
• protect our clients, business and legal rights;
• establish, exercise or defend legal claims;
• cooperate with insurers, professional advisers, regulators or authorities.

Our lawful bases may include legitimate interests, legal obligation and the establishment, exercise or defence of legal claims.

Marketing communications

We may send information about services, offers or availability where:

• you have given consent; or
• marketing to an existing client is otherwise permitted under applicable electronic marketing rules.

You can unsubscribe at any time by contacting us or using an unsubscribe option included in the communication.

We will not sell your personal information to third parties for marketing purposes.

Photographs, testimonials and social media content

Identifiable client photographs, videos, reviews and testimonials will only be published with appropriate permission.

Clinical or treatment photographs may be kept separately as part of a treatment record where they are necessary to monitor progress. Permission to use a photograph for treatment records does not automatically give us permission to publish it for marketing.

Website operation, security and improvement

We may process technical information to:

• operate and maintain the website;
• protect the website against fraud, spam, malicious traffic and cyberattacks;
• diagnose technical issues;
• understand general website performance;
• improve website content and usability;
• remember cookie preferences.

Strictly necessary processing is based on our legitimate interests in providing a secure and functioning website.

Analytics, advertising or other non-essential technologies will only be used in accordance with applicable cookie and consent requirements.

5. When you must provide information

Certain information is necessary for us to arrange an appointment, take payment or safely provide a treatment.

You are not required to provide information that is not necessary. However, if you do not provide information needed to assess a treatment, identify contraindications or manage an appointment, we may be unable to provide the requested service.

Please do not include unnecessary medical information in the general website contact form. More detailed health information should normally be provided through an appropriate consultation process.

6. Cookies and similar technologies

Our website may use cookies and similar technologies.

Cookies are small files or pieces of information stored or accessed on your computer, telephone or other device.

We may use the following categories of cookies:

Strictly necessary cookies

These cookies are required for website security, basic functions, spam prevention, network management and remembering privacy choices.

They may be used without consent where permitted by law.

Preference cookies

These cookies remember choices such as language, display settings or cookie preferences.

Analytics cookies

Analytics cookies help us understand how visitors use the website, which pages are viewed and whether technical problems occur.

Where consent is required, these cookies will not be activated until you have accepted them.

Marketing cookies

Marketing cookies may be used to measure advertising activity, understand interactions with campaigns or display more relevant content.

These cookies require consent and should remain disabled unless you choose to accept them.

Third-party content

Content or links from Facebook, Instagram, booking platforms, maps or other third parties may allow those providers to collect information when you interact with their services.

Those organisations act under their own privacy policies and cookie practices.

You can manage non-essential cookies through the website’s cookie banner or cookie settings. You can also control cookies through your browser, although blocking strictly necessary cookies may affect how the website works.

Withdrawing cookie consent does not affect the lawfulness of processing carried out before consent was withdrawn.

7. Who we share information with

We may share personal information only where necessary with trusted recipients such as:

• website hosting, maintenance and security providers;
• email and communications providers;
• online booking and client management providers;
• payment processing providers;
• accountants and bookkeeping providers;
• insurers;
• professional, legal or compliance advisers;
• IT support providers;
• cloud storage or document management providers;
• regulators, courts, law enforcement agencies or public authorities;
• healthcare professionals or emergency services where necessary to protect vital interests or where you have requested or authorised the disclosure.

Service providers acting on our behalf may only use personal information for agreed purposes and must protect it appropriately.

We may also share information where required by law or where necessary to protect the rights, safety or property of Aga Happy Feet, a client or another person.

We do not sell personal information.

8. Online booking, payment and external services

If you use an external booking, payment, mapping or social media service, the provider may collect personal information directly from you.

The external provider may act as an independent data controller and may have its own lawful bases, retention periods and international data transfer arrangements.

You should review the provider’s privacy notice before submitting information through its platform.

Information received by Aga Happy Feet from an external booking or payment service will be handled in accordance with this Privacy Policy.

9. International transfers

Some technology, email, hosting, booking, payment or social media providers may process information outside the United Kingdom.

Where personal information is transferred internationally, we will take reasonable steps to ensure that an appropriate legal transfer mechanism is used. This may include:

• transfer to a country covered by UK adequacy regulations;
• the UK International Data Transfer Agreement;
• the UK Addendum to approved contractual clauses;
• another legally permitted safeguard.

10. How long we keep information

We keep personal information only for as long as it is reasonably necessary for the purpose for which it was collected, including legal, tax, insurance, professional and dispute-resolution requirements.

Our general retention periods are:

• general enquiries that do not lead to an appointment: normally up to 12 months after the last communication;
• appointment and client administration records: for the duration of the client relationship and for an appropriate period afterwards;
• consultation, treatment and health records: normally up to 7 years after the last treatment, or longer where required by law, insurance conditions, safeguarding requirements or the establishment or defence of legal claims;
• records relating to children: may be kept for a longer period where required by law, insurance conditions or professional standards;
• invoices, payment and accounting records: normally 6 years after the relevant accounting period;
• marketing information: until consent is withdrawn or the information is no longer required;
• marketing suppression records: for as long as necessary to ensure that an opt-out continues to be respected;
• photographs or testimonials used for marketing: until permission is withdrawn or the material is no longer required;
• website security and technical logs: for a limited period appropriate to security, troubleshooting and fraud prevention.

We may keep information for longer where a complaint, legal claim, insurance matter, regulatory enquiry or security incident is ongoing.

At the end of the relevant retention period, information will be securely deleted, anonymised or destroyed.

11. How we protect your information

We use appropriate technical and organisational measures designed to protect personal information against:

• unauthorised access;
• accidental loss;
• alteration;
• misuse;
• disclosure;
• destruction.

These measures may include access controls, password protection, secure devices, software updates, encrypted connections, secure storage, confidentiality procedures and restricted access to treatment records.

No internet transmission or electronic storage method can be guaranteed to be completely secure. However, we review our safeguards and take reasonable steps appropriate to the sensitivity of the information being processed.

12. Children’s information

Some Aga Happy Feet services may be provided to children or young people.

Where appropriate, we may collect:

• the child’s name and date of birth;
• relevant health and treatment information;
• parent or guardian contact details;
• consent or authorisation from a person with parental responsibility;
• appointment, treatment and aftercare records.

We take additional care when handling children’s information. A parent or guardian may be required to attend the appointment or provide appropriate consent, depending on the child’s age, maturity and the nature of the treatment.

13. Your data protection rights

Depending on the circumstances, you may have the right to:

• be informed about how your information is used;
• request access to your personal information;
• request correction of inaccurate or incomplete information;
• request deletion of your information;
• request restriction of processing;
• object to processing based on legitimate interests;
• object to direct marketing at any time;
• request the transfer of certain information in a portable format;
• withdraw consent where processing is based on consent;
• complain about the way your information has been handled;
• ask for information about safeguards used for international transfers.

These rights are not absolute and may be subject to legal exemptions. For example, we may need to retain certain treatment or financial records to comply with legal obligations, insurance requirements or defend legal claims.

To exercise a right, contact us using the details provided in this Privacy Policy. We may need to verify your identity before responding.

We will normally respond without undue delay and within one month. Complex requests may take longer where permitted by law.

14. Automated decision-making

We do not use personal information to make decisions based solely on automated processing that produce legal or similarly significant effects.

15. Social media and external websites

Our website may contain links to Facebook, Instagram, booking platforms and other external websites.

When you visit or interact with an external platform, that organisation may collect personal information independently. Aga Happy Feet is not responsible for the privacy practices, content or security of third-party websites.

Public comments, reviews or messages posted on social media may be visible to other users. Do not publish sensitive health or personal information in a public comment.

16. Changes to this Privacy Policy

We may update this Privacy Policy when our services, website technologies, service providers or legal obligations change.

The latest version will be published on our website with an updated revision date. Significant changes may also be communicated through another appropriate method.

17. Contact and complaints

Questions, requests or concerns about personal information should be sent to:

Aga Happy Feet
Agata Cekliniak
12a Castle Street
Reading
RG1 7RD
United Kingdom

Email: agacekbeauty@gmail.com
Telephone: +44 7476 407770

Please contact us first so that we have an opportunity to investigate and resolve your concern.

You also have the right to complain to the Information Commissioner’s Office, the United Kingdom’s independent data protection regulator. Information about submitting a complaint is available through the ICO’s official website.