Privacy notice

Who is the controller

This website and clinic are operated by GM Investments Group Ltd, trading as The Face Workshop, company number 15026293, registered in England and Wales. Registered office: 71-75 Shelton Street, London WC2H 9JQ. VAT number GB504268409. ICO registration ZB728520.

Contact: hello@thefaceworkshop.co.uk, 020 4572 5676. Clinic: 8 Ely Court, Royal Victoria Place, Royal Tunbridge Wells, Kent, TN1 2SP.

What we collect

• Contact details you give us through the enquiry and waiting-list forms on this website.
• Your name and email address if you join our mailing list.
• If you accept cookies: how you use this website and whether you arrived from one of our adverts. See our cookie policy.
• Booking details you give through our booking provider.
• Purchase details you give through our online shop.
• Health information you give us at consultation. This is special category data and is handled with additional care.

Why we use it, and on what lawful basis

• Responding to enquiries: our legitimate interests in answering people who contact us.
• Our mailing list: your consent, which you can withdraw at any time with the unsubscribe link in every email.
• Website analytics and advert measurement: your consent, given or refused in the cookie banner and changeable at any time under Cookie settings.
• Bookings and treatment: performance of a contract, and for health information, your explicit consent together with the provision of health care.
• Legal obligations: record keeping.

Who processes data for us

• HubSpot, for website form submissions, our mailing list and, if you accept cookies, website analytics. Our HubSpot account is held in HubSpot's EU data centre.
• Google (Google Tag Manager, Google Analytics and Google Ads), only if you accept cookies.
• Meta, for measuring our adverts, only if you accept marketing cookies.
• Aesthetic Nurse Software, for bookings and clinical records.
• Shopify, for the online shop.
• Google Workspace, for email.

How long we keep it

• Clinical records, including consent forms and treatment photographs: 10 years.
• Enquiries: 12 months.
• Mailing list: until you unsubscribe.
• Website analytics: up to 14 months in Google Analytics, and as set out in HubSpot's and Meta's own notices.
• Accounts records: six years.

Your rights

Under UK GDPR you have the right to access your data, to have it corrected, to have it erased, to restrict how we use it, to portability, to object to processing, and to withdraw consent where we rely on it.

To exercise any of these, email hello@thefaceworkshop.co.uk. We will respond within the statutory period.

Complaints

If you are unhappy with how we have handled your information, you can complain to the Information Commissioner's Office at ico.org.uk.

Automated decisions and tracking

We do not make automated decisions about you that have legal or similarly significant effects. Website analytics and advert measurement only run if you accept them in the cookie banner. See our cookie policy.

Some of these providers process data outside the UK, including in the United States. Those transfers are covered by the UK's adequacy regulations, including the UK-US data bridge, or by the standard contractual safeguards the law requires.