Privacy notice

Who is the controller

This website and clinic are operated by GM Investments Group Ltd, trading as The Face Workshop, company number 15026293, registered in England and Wales. Registered office: 71-75 Shelton Street, London WC2H 9JQ. VAT number GB504268409. ICO registration ZB728520.

Contact: hello@thefaceworkshop.co.uk, 020 4572 5676. Clinic: 8 Ely Court, Royal Victoria Place, Royal Tunbridge Wells, Kent, TN1 2SP.

What we collect

• Contact details you give us through the enquiry and waiting-list forms on this website.
• Your name and email address if you join our mailing list.
• Visit counts, without cookies: which pages are viewed, how far down a page people scroll, taps on the booking, phone and email links, which forms are sent (never what you type in them), and how a visit reached us, for example a Google search, one of our adverts, social media or a link. Nothing is stored on your device and no name, contact details or IP address is kept. See our cookie policy.
• If you accept cookies: how you use this website and whether you arrived from one of our adverts, including which advert or search brought you. See our cookie policy.
• Booking details you give through our booking provider.
• Purchase details you give through our online shop.
• Health information you give us at consultation. This is special category data and is handled with additional care.

Why we use it, and on what lawful basis

• Responding to enquiries: our legitimate interests in answering people who contact us.
• Our mailing list: your consent, which you can withdraw at any time with the unsubscribe link in every email.
• Visit counting without cookies: our legitimate interests in seeing how the website is used so we can improve it. You can turn it off at any time on our cookie policy page or under Choose in the cookie banner.
• Website analytics with cookies and advert measurement: your consent, given or refused in the cookie banner and changeable at any time under Cookie settings.
• Bookings and treatment: performance of a contract, and for health information, your explicit consent together with the provision of health care.
• Legal obligations: record keeping.

Who processes data for us

• HubSpot, for website form submissions, our mailing list and, if you accept cookies, website analytics. Our HubSpot account is held in HubSpot's EU data centre.
• PostHog, for visit counting without cookies. The data is held in PostHog's EU data centre in Frankfurt, and the IP address is discarded once the town has been looked up.
• Google (Google Tag Manager, Google Analytics and Google Ads), only if you accept cookies.
• Meta, for measuring our adverts, only if you accept marketing cookies.
• Aesthetic Nurse Software, for bookings and clinical records.
• Shopify, for the online shop.
• Google Workspace, for email.

How long we keep it

• Clinical records, including consent forms and treatment photographs: 10 years.
• Enquiries: 12 months.
• Mailing list: until you unsubscribe.
• Visit counting: 12 months in PostHog, then deleted automatically. Our reports keep totals only.
• Website analytics: up to 14 months in Google Analytics, and as set out in HubSpot's and Meta's own notices.
• Accounts records: six years.

Your rights

Under UK GDPR you have the right to access your data, to have it corrected, to have it erased, to restrict how we use it, to portability, to object to processing, and to withdraw consent where we rely on it.

To exercise any of these, email hello@thefaceworkshop.co.uk. We will respond within the statutory period.

Complaints

If you are unhappy with how we have handled your information, you can complain to the Information Commissioner's Office at ico.org.uk.

Automated decisions and tracking

We do not make automated decisions about you that have legal or similarly significant effects. Google Analytics, HubSpot and advert measurement only run if you accept them in the cookie banner. Visit counting without cookies runs unless you turn it off, and is never used to measure our adverts. See our cookie policy.

Some of these providers process data outside the UK, including in the United States. Those transfers are covered by the UK's adequacy regulations, including the UK-US data bridge, or by the standard contractual safeguards the law requires.