Privacy Notice

1. Who we are

The Kneadful Nook is a registered business name of Kim Lakeman, a sole trader based in Jersey.

For the purposes of the Data Protection (Jersey) Law 2018, Kim Lakeman trading as The Kneadful Nook is the data controller for personal information processed in connection with the business.

The Kneadful Nook is registered with the Jersey Office of the Information Commissioner (JOIC).

JOIC registration number: 103890

2. Contact details

Telephone: 07700 300482

Email: kneadful@thenook.je

3. What this Privacy Notice covers

This Privacy Notice explains how The Kneadful Nook collects, uses, stores, shares and protects personal information when you interact with the business.

This includes when you:

• make an enquiry;
• book, reschedule or cancel an appointment;
• attend an appointment or receive a treatment;
• complete a consultation or consent form;
• communicate by telephone, email, website or social media;
• use SumUp Bookings or related payment services;
• interact with The Kneadful Nook's Facebook Page; or
• otherwise interact with the business.

4. How we collect personal information

Personal information may be collected:

• directly from you by telephone, email or in person;
• through the website, including an enquiry form where available;
• through SumUp Bookings;
• through The Kneadful Nook's Facebook Page or Messenger;
• through physical consultation and consent forms;
• from a parent or guardian where appropriate; and
• from information created as part of administering your booking or treatment.

Where information is collected through a third-party platform, that provider may also process information under its own privacy arrangements.

5. How and why we use personal information

The Kneadful Nook may use personal information to:

• respond to enquiries;
• arrange and administer appointments;
• confirm, reschedule or cancel bookings;
• communicate with you about an appointment;
• provide requested treatments;
• assess treatment safety and suitability;
• maintain consultation and consent records;
• process payments;
• administer permitted no-show charges;
• maintain appropriate business, accounting and treatment records;
• deal with complaints, disputes or customer-service issues;
• administer business social-media channels;
• maintain website and account security;
• prevent fraud, misuse or unauthorised access;
• comply with legal and regulatory obligations; and
• establish, exercise or defend legal rights where necessary.

6. Our lawful bases

Different lawful bases may apply depending on why personal information is being processed.

Contract and pre-contractual steps

Information may be processed where necessary to take steps at your request before entering into a contract, or to perform the agreement between you and The Kneadful Nook for booking and treatment services.

This may include enquiry information, contact information and appointment details.

Legal obligations

Information may be processed where necessary to comply with a legal obligation applying to The Kneadful Nook.

Legitimate interests

Information may be processed where reasonably necessary for legitimate business interests, including:

• administering appointments;
• responding to clients;
• maintaining appropriate records;
• protecting the business and its clients;
• maintaining website and account security;
• preventing misuse or fraud;
• managing complaints or disputes; and
• establishing, exercising or defending legal rights.

Where legitimate interests are relied upon, The Kneadful Nook will consider whether those interests are proportionate and whether your rights and interests override them.

Consent

Consent may be relied upon where it is the appropriate lawful basis and may be withdrawn for future processing at any time.

7. Health and other special-category information

Health information is treated as particularly sensitive.

The Kneadful Nook collects relevant health information where reasonably necessary to determine whether a treatment can be provided safely and appropriately.

For the additional condition required when processing health information, explicit consent is obtained through the consultation and consent process where that is the applicable condition under the Data Protection (Jersey) Law 2018.

Consent must relate to specific purposes and is recorded.

Where another lawful special-category condition applies, information may also be processed under that condition in accordance with the Data Protection (Jersey) Law 2018.

You may withdraw consent to future processing where processing depends upon consent. Withdrawal does not affect processing already carried out lawfully before withdrawal.

Certain information may still need to be retained where permitted or required for legal, insurance, regulatory or legal-claims purposes.

If information reasonably required to assess treatment safety or suitability is not provided, The Kneadful Nook may be unable to provide the treatment.

Clients should avoid sending detailed health or medical information through ordinary email, social-media messages or public comments unless specifically requested. Relevant health information should normally be provided through the consultation process.

8. Clients under 18

The Kneadful Nook will not provide treatment to a client under 18 unless a parent or guardian is present.

A parent or guardian may be required to provide or confirm relevant information and consent.

Information relating to younger clients is handled with particular care and used only where reasonably necessary to:

• administer the appointment;
• assess treatment safety and suitability;
• provide the service;
• maintain appropriate records; and
• meet applicable legal or safeguarding responsibilities.

9. SumUp Bookings and payments

The Kneadful Nook uses SumUp for online booking and payment-related services.

When you use SumUp Bookings, information such as your name, contact information, selected service, appointment date and time, and booking messages may be processed through SumUp and made available to The Kneadful Nook where necessary to administer your appointment.

Payment for an appointment that you attend is normally made in person.

When booking online, SumUp may request card information to secure your appointment against an applicable no-show charge.

The Kneadful Nook does not receive, store or have access to your full card details.

Card information is handled through SumUp. Where the applicable booking conditions are met, The Kneadful Nook may use functionality made available by SumUp to initiate an authorised no-show charge.

SumUp processes information in accordance with its own privacy and legal arrangements. Depending on the particular service and processing activity, SumUp may process information on behalf of The Kneadful Nook and/or under SumUp's own legal responsibilities.

Customers should also review SumUp's current Privacy Policy and applicable terms when using SumUp services.

10. Facebook and social media

The Kneadful Nook maintains a Facebook Page for business information, news and updates, treatment information, general wellbeing content, availability information and promotional content.

The Kneadful Nook may receive personal information where you voluntarily:

• follow or like the Page;
• react to a post;
• comment on content;
• send a private message;
• leave a review or recommendation; or
• otherwise interact with the Page.

Information posted publicly may be visible to other Facebook users according to Facebook's settings and platform rules.

Information provided directly to The Kneadful Nook through private messages or other direct communication will be used only where reasonably necessary to respond to you, administer the business relationship or manage the Page.

The Kneadful Nook does not currently use customer contact details to create direct-marketing mailing lists or send unsolicited marketing emails or text messages.

General promotional posts may nevertheless be published through The Kneadful Nook's own social-media channels and may be shown by Meta to followers or other Facebook users according to Meta's platform operation.

Meta separately processes information under its own privacy arrangements.

For certain processing connected with Facebook Page Insights, Meta and the Page administrator may have joint-controller responsibilities under Meta's applicable controller arrangements.

The Kneadful Nook does not have access to all information Meta may hold about people who view or interact with the Page.

Reviews and testimonials

A customer who posts a review or comment publicly on Facebook does not automatically give The Kneadful Nook permission to reproduce identifiable content on its website or in separate promotional material.

Where identifiable customer feedback is to be deliberately republished for a separate promotional purpose, appropriate permission will be obtained first.

11. Who we may share personal information with

The Kneadful Nook does not sell personal information.

Where reasonably necessary, personal information may be shared with or processed by categories of recipients including:

• SumUp, for booking and payment-related services;
• Meta/Facebook, where you interact through Facebook;
• website-hosting and infrastructure providers;
• business email and communications providers;
• website-development or technical-support providers where access is genuinely required;
• accounting or record-keeping providers where applicable;
• professional advisers;
• insurers;
• legal representatives;
• regulators;
• courts;
• law-enforcement bodies; and
• other authorities where disclosure is required or permitted by law.

Only information reasonably necessary for the relevant purpose should be made available.

Where an external provider acts as a processor on behalf of The Kneadful Nook, appropriate data-protection arrangements will be maintained where required.

Le Salon Hair and Beauty

The Kneadful Nook operates from space rented within Le Salon Hair and Beauty.

The fact that the businesses share premises does not mean that Le Salon Hair and Beauty automatically receives access to The Kneadful Nook's client consultation, treatment or health records.

12. International transfers

Some technology and service providers operate internationally and may process personal information outside Jersey.

Where The Kneadful Nook is responsible for transferring personal information outside Jersey, the transfer will only take place where permitted under applicable data-protection law and using an appropriate lawful transfer mechanism or safeguard where required.

Third-party providers such as SumUp and Meta may also make international transfers under their own legal responsibilities and privacy arrangements.

You may contact The Kneadful Nook if you would like further information about safeguards relevant to a particular transfer for which The Kneadful Nook is responsible.

13. Website hosting and technical information

When you visit The Kneadful Nook website, technical information may be processed automatically by the website or hosting infrastructure.

This may include:

• IP address;
• browser and device information;
• requested pages;
• date and time of access;
• server-log information;
• error information; and
• security-related information.

This information may be processed where reasonably necessary to operate, secure, maintain and troubleshoot the website.

14. Google Maps and external services

The Kneadful Nook website may use Google Maps or provide links to Google Maps to help clients locate the treatment premises and obtain directions.

Where Google Maps content is loaded or an external Google Maps link is followed, Google may receive technical information and may process information under its own privacy and cookie arrangements.

The website may also contain links to third-party services such as SumUp and Facebook.

Once you access a third-party website or service, that provider's own terms and privacy practices apply to its processing.

15. Cookies and similar technologies

The Kneadful Nook does not currently use this website for behavioural advertising or marketing analytics.

The website, hosting infrastructure or third-party services may use essential technical storage, server logging or similar technologies necessary for operation, security or service delivery.

Third-party content, such as an embedded map, may also involve cookies or similar technologies operated by that provider.

If non-essential analytics, advertising technology, tracking pixels, embedded social-media feeds or other significant cookie-based services are introduced in future, the website's privacy and cookie arrangements will be reviewed before those services are deployed.

16. How we protect personal information

The Kneadful Nook takes reasonable technical and organisational measures to protect personal information against:

• unauthorised or unlawful access;
• loss;
• disclosure;
• alteration;
• destruction; and
• misuse.

Physical consultation forms are retained securely with access restricted to the practitioner.

Business accounts and systems are protected using appropriate security measures.

Full payment-card information is handled through SumUp rather than being stored directly by The Kneadful Nook.

Where service providers require access to personal information, access should be limited to what is reasonably necessary for their role.

For security reasons, detailed technical security arrangements are not published.

17. How long we keep personal information

Personal information is not retained for longer than reasonably necessary.

Retention periods are determined by the type of information and the reason it is held.

Relevant considerations may include:

• treatment continuity;
• accounting and tax requirements;
• professional requirements;
• insurance requirements;
• regulatory obligations;
• complaints or disputes; and
• the establishment, exercise or defence of legal claims.

Enquiry information that is no longer required will be deleted or securely destroyed when there is no continuing business or legal reason to retain it.

Consultation and treatment records will be retained only for the period reasonably required under applicable professional, insurance, legal and record-keeping requirements and will be securely destroyed when no longer required.

The Kneadful Nook will maintain and periodically review its retention practices.

18. Your data-protection rights

Under the Data Protection (Jersey) Law 2018, you may have rights including the right to:

• be informed about how your personal information is used;
• request access to personal information held about you;
• request correction of inaccurate or incomplete information;
• request erasure in certain circumstances;
• request restriction of processing in certain circumstances;
• object to certain processing;
• receive certain information in a portable format where the right applies;
• withdraw consent where processing is based upon consent; and
• not be subject to certain decisions based solely on automated processing.

These rights are not absolute and may be subject to legal exemptions or other lawful reasons for continuing to process or retain information.

The Kneadful Nook does not currently use personal information to make decisions about clients solely through automated decision-making or profiling.

To exercise a data-protection right, contact: kneadful@thenook.je

19. Complaints

If you have concerns about how your personal information has been handled, you may contact The Kneadful Nook so that the matter can be investigated.

You also have the right to raise a concern or complaint directly with the Jersey Office of the Information Commissioner.

Telephone: +44 1534 716530

Email: enquiries@jerseyoic.org

You do not have to complain to The Kneadful Nook before exercising your right to contact JOIC.

20. Changes to this Privacy Notice

This Privacy Notice will be reviewed periodically and updated where necessary to reflect changes to:

• business practices;
• services;
• service providers;
• technology;
• regulatory guidance; or
• applicable law.

Where a material change affects how existing client information is processed, appropriate steps will be taken to communicate that change where required.

The version number and last-updated date at the top of this notice identify the current version.