Privacy policy

1. Who we are

VictoriaArpels.com and Victoria Arpels Skin Clinic are trading names of Theta Mind Ltd, registered in England and Wales (company number 16808064). Our registered office is Unit 17 Rookery Business Park, Silver Street, Besthorpe, Attleborough, Norfolk, NR17 2LD.

Theta Mind Ltd is the “controller” of your personal information, which means we decide how and why it is used. In this policy, “we”, “us” and “our” refer to Theta Mind Ltd.

2. How to contact us about your data

If you have any questions about this policy or how we handle your information, you can:

• send a message using our contact form (choose “Something else”);
• call or WhatsApp 07894 756966; or
• write to us at the registered office address above, marked “Data Protection”.

3. The information we collect

When you contact us

If you use our contact form, call, WhatsApp or message us on social media, we collect the details you give us, such as your name, email address, phone number, the treatment or skin concern you are asking about and the content of your message.

When you become a client

To provide treatments safely, we collect information at your skin consultation and treatments, including your contact details, date of birth, skin history, medical history, medications, allergies, lifestyle factors relevant to your skin, treatment records and notes, and your consent forms. Some of this is health information, which is a special category of personal data and is given extra protection.

Photographs

With your permission, we take photographs of your skin or brows before, during and after treatment to plan and track your results. We will only use photographs on our website or social media if you have given separate, explicit consent, and we will not identify you by name unless you agree.

When you visit our website

We and our service providers collect technical information automatically, such as your IP address, browser and device type, pages visited, time spent on pages and how you arrived at the site. This is collected using cookies and similar technologies (see section 8).

4. How we use your information and our lawful basis

• To reply to your enquiry and arrange appointments — necessary to take steps at your request before entering into a contract, or our legitimate interest in responding to enquiries.
• To provide consultations and treatments safely — necessary to perform our contract with you. Health information is processed with your explicit consent and, where relevant, for the purposes of providing health and care treatment.
• To keep client and treatment records — our legal obligations and legitimate interests, including meeting insurance and professional requirements.
• To manage payments and run our business — necessary to perform our contract and comply with tax and accounting law.
• To improve our website and understand how it is used — our legitimate interests, or your consent where cookies require it.
• To send you news and offers — only with your consent. You can opt out at any time.
• To use your photographs or reviews in our marketing — only with your explicit consent, which you can withdraw at any time.

5. Who we share your information with

We do not sell your personal information. We only share it where necessary with:

• our website hosting, security and email providers, who process data on our behalf;
• Google (Google Analytics, Google Tag Manager and reCAPTCHA, which protects our contact form from spam);
• Meta (the Meta Pixel, which helps us measure our advertising on Facebook and Instagram);
• WhatsApp and Instagram, if you choose to contact us that way (their own privacy policies also apply);
• our accountants, insurers and professional advisers where required; and
• regulators, law enforcement or other authorities where we are legally required to do so.

Some of these providers are based outside the UK, for example in the United States. Where your information is transferred outside the UK, we rely on appropriate safeguards such as UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

6. How long we keep your information

• Enquiries that do not lead to an appointment are kept for up to 12 months.
• Client records, including consultation forms, medical history, treatment notes and photographs, are kept for as long as you are a client and afterwards for as long as required by our insurers, professional guidance and the law, in case of any questions or claims about your treatment.
• Financial records are kept for six years to meet tax and accounting requirements.
• Marketing preferences are kept until you unsubscribe or withdraw consent.

When information is no longer needed, it is securely deleted or destroyed.

7. How we keep your information safe

We use appropriate technical and organisational measures to protect your information, including secure systems, restricted access and secure storage of paper records. Only people who need your information to provide your treatment or run the business can access it.

8. Cookies

Cookies are small text files stored on your device. Our website uses:

• Essential cookies that are needed for the website and contact form to work securely (including Google reCAPTCHA).
• Analytics cookies from Google Analytics, which tell us how visitors use the site so we can improve it.
• Marketing cookies from the Meta Pixel, which help us measure and improve our Facebook and Instagram advertising.

You can block or delete cookies in your browser settings at any time. Blocking some cookies may affect how the website works. You can find out more at ico.org.uk.

9. Your rights

Under UK data protection law you have the right to:

• ask for a copy of the personal information we hold about you;
• ask us to correct information that is wrong or incomplete;
• ask us to delete your information, where we no longer need to keep it;
• ask us to restrict or object to how we use your information;
• ask for your information to be transferred to another organisation; and
• withdraw your consent at any time, where we rely on consent.

To make a request, contact us using the details in section 2. We will respond within one month. There is normally no charge.

10. Complaints

If you are unhappy with how we have handled your information, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.

11. Changes to this policy

We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated at the top.