Privacy policy.
Last updated: 14 July 2026
SKN by Amy Cole respects your privacy and is committed to protecting your personal information.
This Privacy Policy explains how we collect, use, store and protect your personal information when you visit our website, contact us, book an appointment, subscribe to our mailing list or receive a consultation or treatment.
1. Who we are
SKN by Amy Cole is an independent skin and beauty business based in Swindon, United Kingdom.
For the purposes of UK data protection law, SKN by Amy Cole is the data controller responsible for your personal information.
Business name: SKN by Amy Cole
Owner and data controller: Amy Cole
Business address: 11 Wallis Drive, Swindon, SN25 4GA
Email: amy@sknbyamycole.com
Questions about this policy or the way your information is handled should be sent to the email address above.
2. The information we collect
Depending on how you interact with us, we may collect the following information.
Personal and contact information
This may include your:
Name
Date of birth
Home address
Email address
Telephone number
Emergency contact details
Appointment and transaction information
This may include:
Appointments booked, changed, cancelled or missed
Treatments and services purchased
Deposits and payments
Gift voucher information
Appointment preferences
Communications relating to bookings
Records relating to our booking and cancellation policies
Payment card information is processed securely by the relevant payment provider. SKN by Amy Cole does not normally receive or retain your complete payment card details.
Consultation and treatment information
To determine whether treatments are suitable and provide services safely, we may collect information relating to your:
Skin type and skin concerns
Treatment goals
Medical history
Allergies and sensitivities
Medication
Pregnancy or breastfeeding status
Relevant health conditions
Previous treatments or procedures
Contraindications
Lifestyle and homecare routine
Skincare products currently being used
Treatment plans and recommendations
Products, equipment and protocols used during treatment
Treatment outcomes, reactions and aftercare
Consent to treatment
Information relating to your health is classed as special-category personal data and receives additional protection under data protection law.
Photographs and videos
With your knowledge and appropriate consent, we may take photographs or videos to:
Assess your skin
Record your starting point
Support consultation and treatment planning
Monitor your progress
Compare before-and-after results
Maintain an accurate treatment record
Photographs taken for assessment or clinical record-keeping will not automatically be used for marketing.
We will request separate permission before using identifiable photographs or videos on our website, social media pages, emails, advertisements, printed materials or other promotional channels.
Website information
When you use our website, we may collect technical information such as:
Your IP address
Browser and device type
Approximate location
Pages visited
Time spent on the website
Links or buttons selected
Referral source
Website interaction and performance information
Cookie and privacy preferences
Some of this information may be collected through cookies, pixels and similar technologies.
Enquiries and communications
We may collect and retain information you provide when contacting us through:
Our website
Email
Telephone or text message
Social media
Online booking forms
Consultation and consent forms
This may include the content of your message and any photographs or information you voluntarily provide.
Please avoid sending sensitive medical details through public social-media comments.
Marketing information
Where applicable, we may collect:
Your email address
Whether you agreed to receive marketing
When and how your consent was obtained
Your communication preferences
Whether you opened or interacted with an email
When you unsubscribed or withdrew consent
3. How we collect your information
We may collect information:
Directly from you when you contact us
When you book through our online booking system
When you complete a consultation or consent form
During a consultation or treatment
When you subscribe to our mailing list
When you use our website
When you interact with our emails
When you interact with embedded social-media content
From a parent or legal guardian where the client is under 18
From technology providers that support our website, bookings, payments and communications
Please ensure that the information you provide is accurate and inform us if anything relevant changes.
4. How we use your information
We may use your information to:
Respond to enquiries
Create and manage your client record
Arrange and manage appointments
Send booking confirmations and appointment reminders
Assess whether a treatment is suitable
Identify contraindications and safety concerns
Recommend suitable treatments and homecare
Create personalised treatment plans
Provide treatments safely
Record products, equipment and protocols used
Provide aftercare information
Monitor treatment progress
Process payments, deposits and refunds
Apply our booking and cancellation policies
Respond to complaints or concerns
Maintain appropriate business and financial records
Meet legal, regulatory, tax, insurance and professional obligations
Protect our business, systems and clients
Maintain and improve our website
Understand how visitors use our website
Measure the effectiveness of our marketing
Show relevant advertising, where consent has been provided
Send marketing communications where permitted
We do not use your health or treatment information to make automated decisions that have legal or similarly significant effects on you.
5. Our lawful bases for using your information
UK data protection law requires us to have a valid lawful basis for processing personal information.
Depending on the circumstances, we may rely on the following lawful bases.
Contract
We may process your information where necessary to:
Arrange or provide a service you requested
Manage your appointment
Take payment
Communicate with you about your booking
Apply our booking and cancellation terms
Legitimate interests
We may process information where reasonably necessary for the legitimate operation and protection of our business, provided that your rights and interests do not override those interests.
This may include:
Responding to enquiries
Maintaining suitable business records
Improving our services
Preventing fraud or misuse
Ensuring the security of our systems
Establishing, exercising or defending legal claims
Legal obligation
We may process and retain information where necessary to comply with legal, tax, accounting, regulatory or insurance requirements.
Consent
We may rely on your consent for activities including:
Sending email marketing
Placing non-essential website cookies
Using analytics and advertising technologies
Publishing photographs, videos, reviews or testimonials
Processing certain sensitive information where explicit consent is appropriate
You may withdraw your consent at any time. Withdrawing consent does not affect processing that lawfully took place before it was withdrawn.
6. Health and other sensitive information
Information about your physical health, skin conditions, medical history, medication and treatment suitability may constitute special-category personal data.
We collect relevant health information to:
Assess whether a treatment is suitable
Identify contraindications
Reduce the risk of adverse reactions
Adapt treatments appropriately
Provide services safely
Maintain an accurate treatment record
Where required, we will ask for your explicit consent to process this information.
We may also retain relevant health and treatment information where necessary to establish, exercise or defend a legal claim or respond to an insurance matter.
You are not required to provide information unrelated to the service. However, failing to provide complete and accurate information may mean that we cannot safely provide a consultation or treatment.
7. Children and young people
Our website is not specifically directed at children.
Where we provide a consultation or treatment to a person under 18, we may require information and consent from their parent or legal guardian.
We may refuse or adapt a treatment where it is not considered appropriate for the client’s age, circumstances or best interests.
Records relating to clients under 18 may need to be retained for longer to comply with insurance, legal or professional requirements.
8. Treatment photographs and marketing permission
Treatment photographs may be retained as part of your confidential client record.
Consent to take photographs for consultation, assessment or record-keeping does not automatically give us permission to use them for marketing.
Where we would like to use photographs, videos, testimonials or results publicly, we will request separate permission explaining, where relevant:
What content will be used
Whether your face will be visible
Whether you will be identifiable
Whether your name will be used
Where the content may appear
Whether it may be used in paid advertising
You can withdraw permission for future marketing use by emailing amy@sknbyamycole.com.
Where reasonably possible, we will stop using the content and remove it from platforms and materials we control. Withdrawal will not affect marketing use that lawfully took place before permission was withdrawn.
Please be aware that once information or images have been published publicly or shared through social media, other people may save, copy or redistribute them outside our control.
Withdrawing marketing permission will not necessarily require us to delete photographs that form part of your confidential treatment record where we have another lawful reason to retain them.
9. Email marketing and Mailchimp
We use Mailchimp to manage mailing-list subscriptions and send marketing emails, including treatment information, clinic news, availability updates and promotional offers.
When you subscribe to our mailing list, information such as your name, email address, subscription status and interaction with our emails may be processed through Mailchimp.
Mailchimp emails may contain tracking technologies that help us understand information such as:
Whether an email was delivered
Whether an email was opened
Whether a link was selected
Which content subscribers appear to find useful
We use this information to understand and improve our communications.
We will send marketing emails where:
You have actively agreed to receive them; or
We are otherwise permitted to contact you under applicable electronic-marketing rules.
You can unsubscribe at any time by:
Selecting the unsubscribe link included in a marketing email; or
Emailing amy@sknbyamycole.com.
After you unsubscribe, we may retain limited information on a suppression list to ensure that you are not accidentally added back to marketing communications.
Booking confirmations, appointment reminders, aftercare information and essential communications about a service you requested are not considered marketing communications.
We do not sell your information to other organisations for their marketing.
10. Cookies and similar technologies
Our website uses cookies, pixels and similar technologies.
Cookies are small files placed on your device when you visit a website. Some cookies are necessary for the website to operate, while others help us understand website activity, measure advertising or provide embedded content.
Essential cookies
Essential cookies support functions such as:
Website security
Basic navigation
Remembering cookie preferences
Providing forms or booking links
Ensuring the website functions correctly
These cookies may be used without consent where they are strictly necessary.
Analytics cookies
With your consent, we use analytics technologies to understand how visitors find and use our website.
Analytics information may include:
Pages visited
Time spent on pages
Approximate geographic area
Browser and device information
Website referral source
General interactions with the website
Advertising cookies and pixels
With your consent, we may use advertising technologies such as Meta Pixel to:
Measure the performance of our advertising
Understand whether someone visited our website after seeing an advertisement
Create advertising audiences
Show advertising that may be more relevant
Understand how visitors interact with our website
Non-essential analytics and advertising technologies should not be activated unless you accept them through our cookie banner.
You can accept, reject or manage non-essential cookies using the controls displayed on our website.
You may also be able to delete or block cookies through your browser settings. Blocking certain cookies may affect the way some website features operate.
11. Google Analytics
With your consent, we use Google Analytics to understand how visitors use our website.
Google Analytics may process information such as:
Your IP address
Approximate location
Device and browser information
Pages viewed
Time spent on the website
Referral source
Website events and interactions
We use this information in an aggregated form to assess website performance, understand which pages are useful and improve the experience for visitors.
Google Analytics should not be activated until you consent to analytics cookies through the website cookie banner.
Information collected through Google Analytics may be processed by Google in countries outside the United Kingdom, subject to the safeguards described in Google’s privacy and data-transfer documentation.
12. Meta Pixel
With your consent, our website may use Meta Pixel, a technology provided by Meta.
Meta Pixel may collect information about your use of our website, including:
Pages viewed
Buttons or links selected
Website visits following an advertisement
Device and browser information
IP address
Certain website actions or events
We may use this information to:
Measure advertising results
Understand how people interact with our advertisements
Build advertising audiences
Show relevant advertisements through Meta platforms such as Facebook and Instagram
Meta may also process this information in accordance with its own privacy policies.
Meta Pixel should not be activated unless you accept advertising or marketing cookies through our cookie banner.
We do not intentionally send consultation details, medical history, treatment records or other special-category health information to Meta through the Pixel.
13. Embedded Instagram content
Our website may display content embedded from Instagram, such as posts, reels or profile information.
When you view or interact with embedded Instagram content, Meta may receive information about your visit, such as:
Your IP address
Device and browser information
The page you visited
Whether you interacted with the embedded content
Information associated with your Meta or Instagram account where you are logged in
Embedded content may use cookies or similar technologies controlled by Meta.
Where required, non-essential embedded content and associated technologies will only load after you have provided the relevant cookie consent.
Your interaction with Instagram is also subject to Meta’s own privacy policies and account settings.
14. Squarespace
Our website is created and hosted using Squarespace.
Squarespace may process technical and website information to:
Host and display our website
Maintain website security
Provide website forms and features
Record cookie preferences
Supply website analytics where enabled
Detect and prevent misuse
Squarespace may use essential cookies required to provide and secure the website.
Information processed by Squarespace is handled according to its own privacy and data-protection terms.
15. Online booking and client records
We use Ovatu to manage appointments, client details, consultation information, treatment records and related communications.
Information entered when you book or complete a consultation form may be processed and stored through Ovatu.
This may include:
Contact details
Appointment history
Consultation information
Treatment notes
Consent records
Relevant treatment photographs
Deposits and transaction information
Booking communications
Ovatu acts as a service provider supporting the management of our client and appointment records.
16. Who we share information with
We may share limited personal information with trusted service providers where necessary to operate our business.
These may include providers of:
Website hosting and management, including Squarespace
Online booking and client management, including Ovatu
Email marketing, including Mailchimp
Website analytics, including Google Analytics
Advertising measurement, including Meta Pixel
Social-media content, including Instagram
Payment processing
Business email and cloud storage
Accounting and bookkeeping
IT support and security
Professional advice
Business insurance
We may also disclose information:
Where required by law
In response to a lawful request from a regulator, court or public authority
To our insurer, solicitor, accountant or professional adviser
In connection with a complaint, incident, insurance matter or legal claim
Where necessary to protect someone’s vital interests
In connection with the sale, restructuring or transfer of the business, subject to appropriate safeguards
Service providers are only permitted to process information as necessary to provide their services and must handle it appropriately.
We do not sell or rent your personal information.
17. International data transfers
Some of the technology providers we use operate internationally or may process information outside the United Kingdom.
This may include providers such as:
Squarespace
Mailchimp
Google
Meta
Ovatu and its supporting providers
Where personal information is transferred outside the United Kingdom, we will take reasonable steps to ensure that an appropriate legal safeguard is used.
Depending on the provider and destination, this may include:
UK adequacy regulations
The UK International Data Transfer Agreement
The UK Addendum to approved contractual clauses
Standard contractual clauses
Participation in a recognised data-transfer framework
Another safeguard permitted by UK data protection law
Further information about the safeguards used by each provider can be found in that provider’s privacy and data-protection documentation.
18. How long we keep your information
We keep information only for as long as reasonably necessary for the purpose for which it was collected, including any legal, insurance, tax and professional requirements.
Our usual retention periods include:
Enquiries that do not result in a booking: normally up to 12 months after the last communication
Client consultation and treatment records: normally at least seven years after the client’s last treatment, or longer where required by our insurer or applicable law
Records relating to clients under 18: for the longer period required by applicable limitation, insurance or professional requirements
Treatment photographs forming part of a client record: generally for the same period as the associated consultation and treatment record
Financial and transaction records: normally six years after the end of the relevant financial year
Mailing-list information: until you unsubscribe or withdraw consent
Marketing suppression records: retained as necessary to ensure that an unsubscribe request continues to be respected
Marketing photographs and videos: until consent is withdrawn, the content is no longer required or we decide to stop using it
Cookie and analytics information: according to our settings and the retention periods applied by the relevant provider
We may retain information for longer where necessary in connection with a complaint, incident, insurance matter or legal claim.
When information is no longer required, it will be securely deleted, destroyed or anonymised.
19. How we protect your information
We take reasonable technical and organisational measures to protect personal information against:
Unauthorised access
Accidental loss
Inappropriate use
Alteration
Disclosure
Destruction
These measures may include:
Password-protected accounts
Access controls
Secure booking and payment providers
Device security
Software updates
Account authentication
Secure cloud systems
Limiting access to people who genuinely require it
However, no website, electronic communication or storage system can be guaranteed to be completely secure.
20. Your data-protection rights
Depending on the circumstances, you may have the right to:
Ask for a copy of the personal information we hold about you
Ask us to correct inaccurate or incomplete information
Ask us to delete your information
Ask us to restrict how your information is used
Object to certain uses of your information
Receive certain information in a portable format
Withdraw consent where processing is based on consent
Object to direct marketing at any time
Raise a concern about how your information is handled
These rights are not absolute.
For example, we may need to retain information to meet a legal obligation, comply with insurer requirements or establish, exercise or defend a legal claim.
To exercise one of your rights, email:
We may need to verify your identity before responding.
We normally respond within one month, although additional time may be permitted for particularly complex requests.
21. Complaints
Please contact us first if you have concerns about the way your information has been handled. We will take your concern seriously and aim to resolve it.
You also have the right to complain to the Information Commissioner’s Office.
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113
Further information is available through the Information Commissioner’s Office website.
22. Third-party websites
Our website may contain links to external websites, booking systems and social-media platforms.
We are not responsible for the content, security or privacy practices of websites operated by other organisations.
You should review the privacy policy of any external website or service you use.
23. Changes to this Privacy Policy
We may update this Privacy Policy where our services, systems, suppliers or legal responsibilities change.
The most recent version will be published on this website with its last-updated date.
Where a change is significant, we may also communicate it to clients or mailing-list subscribers where appropriate.