Privacy Policy
Last updated: 5 September 2026
Shaza Aesthetics ("we", "us", "our") is committed to protecting your privacy. This policy explains what personal data we collect, why we collect it, how we use it, and the rights you have over it, in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Who we are
Shaza Aesthetics
8A Quarry Hill Parade, Tonbridge, England, TN9 2HR, UK
What data we collect
- Contact form submissions: name, email address, phone number (if provided) and the content of your message.
- Data rights requests: name, email address, and any details you provide when exercising a data protection right.
- Client photos/videos: if you consent to before/after photos or videos being taken during a consultation or treatment, these may be stored and, only with your separate explicit consent, published in our online gallery.
- Technical data: a one-way, non-reversible hash of your IP address is stored alongside form submissions purely to detect and block abuse (e.g. spam). We do not store your raw IP address long-term, and we do not use cookies for advertising or tracking.
Why we process your data and our legal basis
| Purpose | Legal basis |
|---|---|
| Responding to enquiries submitted via the contact form | Legitimate interest in running our business / steps prior to a contract |
| Publishing before/after photos or videos in our gallery | Your explicit, separately-given consent |
| Handling data protection requests | Legal obligation under UK GDPR |
| Preventing spam and abuse of our contact forms | Legitimate interest in protecting our systems |
How long we keep your data
Contact form messages are kept for as long as reasonably needed to handle your enquiry and are periodically reviewed and deleted. Client photos/videos used for treatment records are retained in line with our clinical record-keeping obligations; anything published to the public gallery is removed immediately if you withdraw consent (see "Your rights" below).
Who we share your data with
We do not sell your personal data. Our website is hosted on infrastructure operated by our hosting provider, which processes data purely as our data processor to keep the site running. We do not share your data with any other third party except where required by law.
Cookies
This site does not use tracking or advertising cookies. Only cookies strictly necessary for the site to function (such as keeping the clinic owner signed in to the content management area) are used.
Your rights
Under UK GDPR you have the right to:
- Ask what personal data we hold about you and receive a copy (right of access)
- Ask us to correct inaccurate data (right to rectification)
- Ask us to delete your data, including withdrawing consent for any photo or video of you (right to erasure / "right to be forgotten")
- Object to or restrict certain processing
- Request a portable copy of data you provided to us
- Complain to the UK Information Commissioner's Office (ICO) at ico.org.uk if you are unhappy with how we handle your data
You can exercise any of these rights, including the right to delete your data, on our Your Data & Right to Delete page, or by writing to us at the address above. We will respond within one month as required by law.
Security
We apply technical measures appropriate to the sensitivity of the data we hold, including encrypted connections (HTTPS), access controls on our content management system, and validation of all data submitted through our forms.
Changes to this policy
We may update this policy from time to time. The date at the top of this page shows when it was last revised.
Contact us
If you have any questions about this policy or how we handle your data, please write to us at the address above or use our contact form.