PRIVACY POLICY

DRAFT FOR REVIEW — NOT FOR PUBLICATION

Prepared 6 October 2026. Publication is on hold until retention rules, marketing/contact exports, analytics consent behaviour, international-transfer arrangements and the complete provider inventory have been checked. Bracketed review notes must be resolved and removed before publication.

1. WHO IS RESPONSIBLE

DELIKIPOS HAIRDRESSING LTD operates BestSalons.com and is the controller of personal information used to run the directory and advertising service. Company number: 10465250. Registered office: 12 Duke Street, Cardiff, Wales, CF10 1AY. Contact the BestSalons team at hello@bestsalons.com for privacy enquiries, rights requests or complaints.

This notice covers visitors, people who contact us, listed business owners and representatives, and Spotlight advertisers. Business contact details can be personal information when they identify an individual. It does not replace the privacy notice of a salon or another website you choose to visit.

2. INFORMATION AND SOURCES

Enquiries and complaints: our contact form asks for first name, last name, email address and a message. We also receive information and supporting documents you send by email, including correction, image-rights and privacy correspondence.

Listings and advertising: directory and Spotlight records contain business names, locations, website and contact links, service descriptions and images. Information may identify owners, sole traders or staff. It comes from submissions and research of publicly available business information. A public source does not remove an individual's data-protection rights. [Review: record the actual research sources and any imported personal information.]

Advertiser intake: the form asks for salon name, telephone number, full salon address, a description of up to 300 characters, checkout email and a salon logo. Website or booking links and Instagram, Facebook and TikTok links are optional. Guest checkout is offered, with sign-in optional.

Advertiser accounts and orders: we use contact and business information, the chosen city/category and placement, account/member identifiers, order and subscription references, payment status and correspondence to administer the service. Stripe is the connected card-payment provider. Payment information is handled through the checkout and payment services; we receive the transaction information needed to manage the order.

Waiting-list records: the configured fields include name, salon, email, phone, website, message, city/category/country, source page, language, consent record, status and submission date. [Review: confirm which fields the live form requires and how the list is used.]

Website use: Wix hosting and site services process technical information needed to deliver the website, such as device/browser and connection information. Google Tag and Microsoft Clarity are enabled in site settings. These tools can process page interactions and usage information; Clarity provides heatmaps and session-replay features. The Cookie Policy must identify the technologies actually used and their controls. [Review: confirm Google destinations, Clarity masking/settings, data fields and consent behaviour before publication.]

3. PURPOSES AND LEGAL BASES

We use enquiry details to respond, investigate complaints and correct records. Our legitimate interests are operating an accurate directory, responding to people who contact us and resolving disputes; processing necessary to meet a legal duty relies on that duty instead.

We use advertiser information to take requested steps before a contract and perform an advertising contract with an individual advertiser. For representatives of companies, our legitimate interest is administering the company's contract and communicating with its representatives. Relevant accounting, tax and rights-request processing is based on our legal obligations.

For directory information identifying individuals, the proposed basis is our legitimate interest in providing relevant local business information, subject to a necessity and balancing assessment and the right to object. [Review: complete and record that assessment; this notice does not itself establish a lawful basis.]

Security and abuse prevention serve our legitimate interests in protecting the service and its users, or a specific legal obligation where one applies. Optional analytics and marketing require their own applicable legal basis and any consent required for device storage/access. [Review: confirm actual marketing activities and consent configuration. Do not publish a claim that tracking waits for consent until tested.]

4. WHO RECEIVES INFORMATION

Wix supplies hosting, forms, member accounts, contact management and subscription facilities used by the website. Stripe supplies the connected payment service. Google Workspace hosts hello@bestsalons.com and handles email correspondence. Usercentrics supplies the configured consent-management service. Google and Microsoft provide tracking tools enabled in the configuration. [Review: establish the actual data received, consent behaviour and recipient entities before publishing a definitive processing description.]

Listing content is intended for public display. Checkout email, resume-token and order information are held separately in FeaturedSalonPrivateDetails in the inspected code. [Publication blocker: the intake also saves unpaid business descriptions, images and contact details in the public-read FeaturedSalons collection before payment. Six pending records have business contact details and PUBLISHED status. Anonymous access was not tested. Resolve the storage/access design, then describe when submitted information becomes public accurately.]

Information may also be disclosed to professional advisers or authorities where necessary for advice, legal obligations or legal claims. An ownership connection with Lazarou does not by itself establish a purpose or lawful basis for sharing private enquiries. [Review: confirm whether information is in fact shared with connected salon businesses, and describe any such sharing accurately.]

5. INTERNATIONAL PROCESSING

Providers may process information outside the United Kingdom. Wix publishes its data-processing agreement and subprocessor information. Google Workspace and Stripe have their own contractual and privacy arrangements. [Review: identify the entities, locations and applicable safeguards for the services actually used, including Google tracking, Microsoft Clarity and other apps; explain how a copy can be obtained. Do not claim safeguards have been implemented without checking.]

6. RETENTION

[Publication blocker: confirm the periods or meaningful retention criteria actually applied to enquiries and complaints, directory research, waiting-list entries, accounts, advertising contracts, financial records, consent records and analytics. Include deletion/review arrangements and any justified legal holds. No fixed retention period has been assumed in this draft.]

7. YOUR RIGHTS AND OBJECTIONS

Depending on the applicable law and circumstances, you may request access to your personal information, correction, erasure, restriction or a portable copy. You may withdraw consent at any time without affecting the lawfulness of earlier processing. Some rights have legal exceptions.

RIGHT TO OBJECT: you may object to processing based on legitimate interests for reasons relating to your circumstances. You may object to direct marketing at any time, including related profiling. Email hello@bestsalons.com with 'Privacy request' in the subject line. You do not need to buy advertising or create an account. We may request proportionate information to confirm identity or authority where necessary.

We will handle rights requests within the applicable statutory time limits and explain any lawful extension or refusal. You may raise a concern with us and complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or another competent supervisory authority. Where the UK complaints duty applies, we will acknowledge a data-protection complaint within 30 days and respond without undue delay. Complaints and rights-request deadlines are distinct.

8. LINKS, SECURITY AND UPDATES

Salon website, telephone and directions links let you contact third parties directly. Those services have their own practices. Our responsibility for our own handling of information remains unchanged.

[Review: confirm the security measures actually used, access controls, deletion processes and whether any legally significant automated decisions occur. Avoid unsupported security guarantees or assertions that no profiling occurs.]

We will date published changes to this notice and provide further information where required for a new purpose. The final notice will state its effective date. Contact: hello@bestsalons.com.