Privacy Policy
Last updated: 23 September 2026
Who is responsible
JC LAB LTD (company number 16613763), 7 New Lane, Selby, England, YO8 4QB, is the controller of personal information used to operate this salon and website. Contact support@jclabltd.com or +44 7453571355 with privacy questions.
Information we use and why
We use your name, email, telephone number, billing address, selected services, appointment preferences, order and payment status, and correspondence to process your purchase, arrange appointments, provide customer support and handle refunds. Our legal basis is taking steps at your request before a contract and performing that contract. Required checkout information is needed to accept and administer your order.
We keep transaction records to meet accounting and legal obligations. We may use limited technical information such as IP address, browser details and security logs for our legitimate interests in protecting the website, preventing fraud and resolving disputes. We balance these interests against your rights. Optional analytics and marketing technologies require consent where applicable. Marketing consent, if requested, is separate from purchase; you may withdraw it at any time.
Health and suitability information
Please do not put medical information in checkout notes or general website forms. Where a practitioner needs relevant allergy, patch-test or other health information to assess a treatment, we will explain what is needed and obtain your explicit consent before collecting it, unless another lawful special-category condition applies. Only information necessary for suitability and safety will be requested, with access limited to those who need it. You can withdraw consent, although we may then be unable to safely provide the relevant treatment; unprovided services are refundable under our cancellation policy.
Payments and service providers
We use SureCart to operate checkout and order management and Stripe to process payments and help prevent fraud. They receive the information necessary for those functions and may process some information as independent controllers under their own policies. Payment card details are entered into the payment provider's secure fields; do not send them to us by email. We do not store full card numbers or security codes.
Website hosting, email delivery and technical support providers may process information on our behalf to operate the service. We may disclose necessary information to professional advisers, authorities where legally required, or parties involved in a legal claim. We do not sell customer personal information. See SureCart's privacy policy and Stripe's privacy policy.
International processing
Service providers may process information outside the UK, including in the United States. Where required, transfers must be protected by a recognised adequacy decision or appropriate contractual safeguards, including applicable UK transfer terms. Contact us to request information about the safeguards relevant to your data.
How long we keep information
Our retention policy is to retain order and financial records for up to six years after the relevant financial year, or longer only where a legal obligation or an ongoing dispute requires it. General enquiries are normally deleted within 12 months after resolution. Health and suitability information is reviewed at least annually and deleted when no longer necessary for the treatment relationship, legal obligations or legal claims. We retain only what is necessary for those purposes.
Your rights
Depending on the circumstances, you can request access, correction, deletion, restriction, portability or object to processing based on legitimate interests. You can withdraw consent without affecting the lawfulness of earlier processing. Contact support@jclabltd.com; we may need proportionate information to verify your identity. We normally respond within one month and explain any lawful extension.
You may complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint. You may also have rights under other applicable privacy laws. Contacting us first is helpful but is not required before approaching a regulator.
Cookies, security and updates
See our Cookie Policy for browser-storage information and consent controls. We use HTTPS and restrict access to personal information; no system can be guaranteed completely secure. Contact us promptly if you suspect misuse of your information. Material policy changes will be published here with an updated date.
