Privacy policy

Last updated: 19 October 2026

1. Who we are

The controller of your personal data is Plan4services Ltd, trading as Plan4Beauty, registered in England and Wales (company number 12693334), registered office 9 Carn Court, North Drive, Brighton, BN2 0HR, England. We are registered with the Information Commissioner's Office (ICO), registration number [to be added].

For anything about your data, including using your rights, email [email protected] with "Data protection" in the subject line.

2. What this policy covers

This policy covers www.plan4beauty.co.uk: browsing it, the find-a-salon directory, the provider apply form, and emailing us. If you use the Plan4Beauty app as a customer, salon owner or staff member, the app's privacy policy also applies; open it at app.plan4beauty.co.uk. In the app, a salon or clinic is usually a separate controller for its own customer records, and the app's policy explains who is responsible for what.

3. The data we collect

Apply form (salons and clinics): business name, your name and role, town, website or social handle, business type, treatments and indicative prices, booking system, current payment arrangements, email, phone and best time to call, and anything you write in free-text fields. Please don't include health information about clients.
Emails you send us: your email address, name and whatever you include.
Analytics, only if you accept analytics cookies: pages visited, how you arrived, approximate location (city level), device and browser type, and an online identifier stored in a cookie. See our cookies policy.
Technical data: like any website, our hosting and security providers receive your IP address, browser details and the pages requested, in server and security logs, so the site can be delivered and protected from attack.
Find-a-salon: if you search by postcode, the postcode is sent to postcodes.io to find its location. Map tiles are loaded from OpenStreetMap, which sees your IP address. We don't store your searches.

We don't collect special category data (such as health data) through this website.

4. How we use it, and our lawful basis

Purpose	Data	Lawful basis
Contacting you about joining as a provider, assessing fit, and onboarding	Apply form data	Steps at your request before entering a contract; legitimate interests in growing our business
Answering your emails and questions	Email data	Legitimate interests in responding to enquiries
Understanding how the website is used, to improve it	Analytics data	Consent, which you can withdraw at any time
Delivering the website, keeping it secure, and preventing fraud and abuse	Technical data	Legitimate interests in running a secure website
Meeting legal obligations, and establishing or defending legal claims	Any of the above, where relevant	Legal obligation; legitimate interests

Where we rely on legitimate interests, we have balanced them against your rights. You can ask us for details, and you can object (see your rights). We only use data for the purpose we collected it for, unless a new purpose is compatible with it. If we need to use it for an unrelated purpose, we'll tell you and explain the legal basis first.

5. Automated decisions, profiling and AI

We don't make decisions about you based solely on automated processing that have legal or similarly significant effects. Applications to join as a provider are reviewed by a person. If we ever use AI tools to help handle data (for example, summarising an enquiry), we assess the privacy risks first, keep a person responsible for any decision, and update this policy.

We don't sell personal data. We share it only with:

Our service providers, who process it on our instructions under contract: website hosting, content delivery and security (Cloudflare), email, and the Plan4Beauty app platform, which receives apply-form submissions.
Google (Google Analytics and Google Tag Manager), only if you accept analytics cookies.
postcodes.io and OpenStreetMap, as described above, when you use find-a-salon.
Professional advisers (lawyers, accountants, insurers) where needed.
Authorities (police, regulators, courts) where the law requires it, or to prevent fraud or protect rights.
A buyer or investor, if all or part of our business is sold or restructured, under confidentiality and only so far as needed.

7. International transfers

Some providers, including Google and Cloudflare, may process data outside the UK and EEA, including in the United States. When that happens we make sure it's protected by an approved safeguard: a UK or EU adequacy decision (including the UK-US data bridge and the EU-US Data Privacy Framework, for certified companies), or the UK International Data Transfer Agreement / Addendum or EU Standard Contractual Clauses. Ask us for details of the safeguard used for a particular transfer.

8. Keeping your data secure

The website is served only over encrypted connections (HTTPS). Access to personal data is limited to people who need it for their work, who are bound by confidentiality. Our providers are chosen for their security standards. If a personal data breach happens that is likely to put you at risk, we'll tell you and the ICO where the law requires.

9. How long we keep it

Apply-form data if your business doesn't join: 12 months after our last contact, then deleted. If you join, it becomes part of your provider account and the app's policy applies.
Emails: as long as needed to deal with your enquiry, then up to two years for our records.
Analytics data: held by Google for the retention period set in our Google Analytics account (no longer than 14 months). Cookie lifetimes are in the cookies policy.
Your cookie choice: 12 months, in your own browser.
Server and security logs: short periods set by our hosting and security providers.

We may keep data longer if the law requires it, or to deal with a complaint or legal claim.

10. Your rights

Under UK GDPR (and the EU GDPR, if you are in the EU or EEA) you have the right to:

Access: get a copy of your personal data;
Rectification: have inaccurate or incomplete data corrected;
Erasure: have your data deleted where there's no good reason to keep it;
Restriction: ask us to pause using your data, for example while a dispute is resolved;
Objection: object to processing based on legitimate interests, and to direct marketing at any time;
Portability: receive data you gave us in a machine-readable format, or have it sent to someone else;
Withdraw consent at any time, for example by turning off analytics in cookie settings. This doesn't affect anything done before you withdrew.

To use any right, email [email protected]. It's free, unless a request is clearly unfounded, repetitive or excessive, when we may charge a reasonable fee or refuse. We may ask you to confirm your identity first, so we never give your data to the wrong person. We'll reply within one month. If your request is complex, or you've made several, we may extend that by up to two further months and will tell you why within the first month.

11. Marketing

We only send marketing emails to business contacts where the law allows, and every message has an unsubscribe link. You can also opt out at any time by emailing [email protected]. We'll still send messages we need to send to manage an application or account.

12. Cookies

Optional cookies are only used with your consent. Our cookies policy lists each cookie and how to change your choice.

13. Children

This website and the Plan4Beauty service are for adults (18 and over). We don't knowingly collect data from children through this website.

14. Changes to this policy

We'll update this policy when our use of data changes. The date at the top shows the latest version. If a change affects what you've consented to, we'll ask again.

15. Contact and complaints

Questions or concerns: [email protected]. We'd like the chance to put things right, but you can complain to the regulator at any time:

UK: Information Commissioner's Office, ico.org.uk/make-a-complaint, 0303 123 1113.
EU/EEA: the data protection authority in the country where you live or work, listed at edpb.europa.eu.