Privacy Policy

 PRIVACY POLICY

Wig and Weaves by Hediye Garcia

Last updated: 12 October 2026

WHO IS RESPONSIBLE FOR YOUR INFORMATION?

Hediye Garcia, trading as Wig and Weaves by Hediye Garcia, is responsible for the personal information used by the business.

For privacy enquiries or to exercise your data protection rights, email hediyegarcia@gmail.com. My business postal address is available on the website’s Contact page.

WHAT INFORMATION DO I COLLECT?

Depending on your enquiry, purchase or appointment, I may collect:

•⁠  ⁠Your name, email address, telephone number and delivery address.

•⁠  ⁠Messages, appointment details, order information and payment records.

•⁠  ⁠Hair preferences, measurements and consultation notes.

•⁠  ⁠Relevant information you choose to provide about hair loss or health.

•⁠  ⁠Client photographs, with your permission.

Please only provide health information that is relevant to your consultation or service.

WHY DO I USE YOUR INFORMATION?

I use your information to answer enquiries, arrange appointments, advise on suitable pieces, fulfil orders, provide ongoing care and handle returns or complaints.

My lawful bases include taking steps at your request before entering a contract, performing a contract, meeting legal obligations and legitimate interests in managing enquiries, maintaining appropriate service records and resolving disputes.

Where I rely on legitimate interests, I consider your rights and reasonable expectations.

HEALTH INFORMATION AND CONSULTATION NOTES

Information about a health condition is treated as sensitive personal information.

Where I rely on your explicit consent to record and use health information, I will explain what is needed and why, and record your agreement. You may withdraw that consent by contacting me.

Consultation notes are held separately in the salon. They are used to support suitable advice, fitting and ongoing services.

CLIENT PHOTOGRAPHS

Photographs may be taken with permission to record your hair, fitting or results.

Permission to keep photographs privately is separate from permission to publish them. I will seek specific permission before using identifiable client photographs on my website, social media or promotional materials.

You may decline photography or promotional use without affecting your purchase or appointment.

Private client photographs are stored on my phone and in iCloud. They are normally kept for around six months and then deleted from both locations.

Any agreed public use will be explained separately. You can withdraw consent for future use and ask me to remove photographs from channels I control. I cannot guarantee removal of copies independently shared by other people.

WHO MAY RECEIVE YOUR INFORMATION?

Relevant information may be processed by service providers used to run the business, including website hosting, email, booking, payment, cloud storage and delivery providers.

These may include GoDaddy, Google/Gmail, Apple iCloud, Fresha, payment providers and couriers, depending on the service you use.

Only information necessary for the relevant purpose is shared. Health-related consultation notes are not routinely sent to couriers or payment providers.

Information may also be disclosed where required by law or necessary for legal claims.

Some providers may process information outside the UK. Where restricted international transfers occur, applicable data protection safeguards are required. You can contact me for information about the arrangements relevant to your data.

HOW LONG IS INFORMATION KEPT?

Private client photographs are normally retained for around six months.

Other records are retained for as long as reasonably necessary for their purpose. Relevant factors include ongoing client care, the last appointment or enquiry, legal and tax requirements, and the need to resolve complaints or claims.

Consultation records are reviewed and information that is no longer needed is securely disposed of. Financial records may need to be retained longer than photographs or routine enquiries.

MARKETING

I do not currently operate an email newsletter. Sending an enquiry does not automatically subscribe you to marketing.

COOKIES

The website may use cookies and similar technologies. Details of the technologies used and available choices should be provided through the website’s cookie information and settings. This privacy policy does not itself give consent for optional tracking.

YOUR RIGHTS

Depending on the circumstances, you may request access to your information, correction, deletion, restriction of use or transfer of certain information. You may also object to processing based on legitimate interests.

Where processing relies on consent, you can withdraw it at any time. This does not affect lawful processing carried out before withdrawal.

These rights are subject to legal conditions and exceptions. I may need to verify your identity before responding.

Contact hediyegarcia@gmail.com to make a request.

You can also raise a concern with the Information Commissioner’s Office at ico.org.uk or by calling 0303 123 1113.

UPDATES

This policy may be updated when business practices change. The latest version and its update date will appear on this page.