Privacy Statement

1. Who We Are

MP Beauty Aesthetics is a beauty and aesthetics clinic based at 25 Queen St, Derby, DE1 3DS. We are the data controller responsible for your personal data collected through this website and our booking system.

If you have any questions about this privacy statement or how we handle your data, please contact us at info@mpbeautyaesthetics.co.uk.

2. What Data We Collect

We collect the following personal data when you use our website or booking system:

• Identity data — your full name
• Contact data — email address and phone number
• Booking data — appointment details, treatment selections, and payment method
• Account data — login credentials if you create an account (managed securely via Microsoft Azure AD B2C)
• Payment data — deposit and payment information processed securely via Stripe (we do not store card details)
• Communication preferences — whether you have consented to SMS reminders

3. How We Use Your Data

We use your personal data for the following purposes:

• To process and manage your appointment bookings
• To send you appointment confirmation and reminder emails
• To send SMS reminders where you have given consent
• To process deposit and treatment payments
• To manage your customer account
• To respond to your enquiries
• To send you updates and newsletters where you have subscribed

Our lawful basis for processing your data is the performance of a contract (your booking) and, where applicable, your consent (for marketing communications).

4. Who We Share Your Data With

We share your data only with trusted third-party service providers necessary to operate our business:

• Microsoft Azure — cloud hosting, authentication, and data storage
• Stripe — secure payment processing
• Zoho — email communications and mailing list management

We do not sell, rent, or trade your personal data to any third parties for marketing purposes.

5. Data Retention

We retain your personal data for as long as necessary to provide our services and comply with our legal obligations. Booking records are retained for a minimum of 3 years for business and accounting purposes. Account data is retained until you request deletion.

6. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

• Right of access — to request a copy of the data we hold about you
• Right to rectification — to request correction of inaccurate data
• Right to erasure — to request deletion of your data where there is no lawful reason to retain it
• Right to restrict processing — to request that we limit how we use your data
• Right to data portability — to receive your data in a structured, machine-readable format
• Right to object — to object to processing based on legitimate interests or for direct marketing

To exercise any of these rights, please contact us at info@mpbeautyaesthetics.co.uk. We will respond within 30 days.

7. Cookies

Our website uses session cookies to maintain your login state and booking progress. These are essential cookies required for the site to function and do not require consent. We do not use tracking or advertising cookies.

8. Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. All data is stored securely on Microsoft Azure infrastructure and all payment data is processed by Stripe using industry-standard encryption.

9. Changes to This Statement

We may update this privacy statement from time to time. Any changes will be posted on this page with an updated date. We encourage you to review this page periodically.

10. Complaints

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.