Privacy & cookies
Clear, plain-English information about how we look after your personal data.
Last updated: 4 November 2026
1. Who we are
Shiny Nails Croydon (“we”, “us”) is a nail salon at 4 Norfolk House, Wellesley Road, Croydon CR0 1LH. We are the data controller for the personal data collected through this website and in our salon. If you have any question about your data, email Shinynails4@gmail.com, call +44 7446 934345 or write to us at the address above.
We follow the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).
2. The information we collect
- Account details – your name, email address, mobile number and password (stored only as a one-way encrypted hash – we can never see it). If you sign in with Google or Apple we receive your name, email address and an account identifier; we never receive your Google or Apple password.
- Bookings – the treatments, date, time and technician you choose, any notes you add (for example the shape or colour you want), vouchers used and your booking history.
- Shiny Club – points earned and spent, your member tier, vouchers, who referred you or whom you referred and, only if you add it, the day and month of your birthday (never the year).
- Health information you choose to share – for example an allergy or a nail condition you tell us about so we can treat you safely. We only use this to look after you and keep it to the minimum needed.
- Payments – if you pay online, the payment is handled by our payment provider. We receive confirmation of the amount, date and status, but never your full card details.
- Messages – what you send through our contact form, by email or social media, and messages typed into the chat assistant on this website.
- Virtual try-on (Design your nails) – when you use a hand photo or your camera, the image is processed only on your own device by hand-tracking software running in your browser. It is never uploaded to us or stored, and we never see it. To run, your browser downloads the open-source tracking files from Google's MediaPipe service and the jsDelivr CDN; like any website, those services see your IP address but receive no image.
- Technical data – your IP address, browser type and the pages you request, recorded in security logs and used to stop abuse (for example too many failed sign-in attempts).
3. Why we use it and our lawful basis
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Creating your account, taking and managing bookings, confirmation and reminder emails, contacting you about changes | Contract – needed to provide the service you ask for |
| Running Shiny Club (points, tiers, birthday treat, referrals, vouchers) | Contract – the free membership terms |
| Recording allergies or conditions you tell us about | Your explicit consent, so we can treat you safely |
| Thank-you and Google review request after a visit, service messages | Legitimate interests – improving our service; you can object at any time |
| Offers, “time for an infill” and “we miss you” emails | Consent – only if you ticked the box; withdraw any time |
| Website security, fraud and abuse prevention, keeping records | Legitimate interests and legal obligations |
| Anonymous visitor statistics (Google Analytics) | Consent via our cookie banner |
| Accounting and tax records of payments | Legal obligation |
4. Emails and marketing
We send booking confirmations, reminders and short service messages to every customer because they are part of the service. Promotional emails are sent only if you opted in, and every one contains an unsubscribe link. You can also change your choice in My account or by emailing us. We never sell or rent your details.
5. Who we share it with
We only share personal data with trusted providers who process it on our behalf, under written terms that protect it:
- Hostinger – website and database hosting, and email delivery.
- Google – “Continue with Google” sign-in, maps, and (only with your consent) Google Analytics.
- Apple – “Sign in with Apple”, if you choose it.
- Our payment provider (for example Stripe) – if you pay online.
- Meta (Facebook / Instagram) – only if you choose to load our Facebook feed or message us through Messenger or Instagram.
- Professional advisers (such as accountants) and authorities where the law requires it.
6. International transfers
Some providers above may store data outside the UK. Where they do, the transfer is protected by UK adequacy regulations or the UK International Data Transfer Agreement / Addendum, as required by UK law.
7. How long we keep it
| Data | Kept for |
|---|---|
| Account, bookings and Shiny Club records | While your account is open and up to 2 years after your last visit |
| Payment and accounting records | 6 years (UK tax law) |
| Chat assistant messages | 90 days |
| Contact form messages | Up to 12 months |
| Security logs and failed sign-in records | Up to 30 days |
You can delete your account yourself at any time from My account; we then remove or anonymise your personal data, keeping only what the law requires.
8. How we protect your data
- The whole website runs over an encrypted HTTPS connection.
- Passwords are stored only as strong one-way hashes; sign-in attempts are rate-limited to block guessing.
- Every form is protected against cross-site request forgery, and the site sends modern browser security headers.
- Admin access is limited to salon staff who need it; private files and folders are blocked from public access.
- We never ask for card details, passwords or sensitive information by email, chat or social media.
9. Your rights
Under UK GDPR you have the right to: access a copy of your data; correct anything inaccurate; ask us to delete it; restrict or object to how we use it (including marketing at any time); data portability; and to withdraw consent whenever we rely on it. Email Shinynails4@gmail.com – we reply within one month and there is normally no charge.
10. Cookies
| Cookie / storage | Purpose | Type |
|---|---|---|
shinynails_sid | Keeps you signed in and protects forms | Essential, deleted when you close the browser |
shinyConsent (browser storage) | Remembers your cookie choice | Essential |
shinyMuted, chat history (browser storage) | Remembers if you muted the welcome sound and keeps your chat during the visit | Functional, stays on your device |
Google Analytics (_ga, _ga_*) | Anonymous visit statistics | Optional – only after you click “Accept” |
| Facebook, Google Maps | Set by these services when their embedded content loads | Third-party; Facebook loads only after consent or your click |
You can change your choice at any time with Cookie settings or in your browser settings.
11. Children
Our online account and booking service is intended for people aged 16 and over. Younger clients should be booked by a parent or guardian.
12. Changes and complaints
We may update this policy and will show the new date at the top of this page. If you are unhappy with how we have used your data, please contact us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office (ico.org.uk, 0303 123 1113).