Privacy Policy
This Privacy Policy explains how Spectra Clinic ("we", "us", "our") collects, uses and protects your personal data when you use our website, contact us, subscribe to our newsletter, leave a review or buy products from us. We are committed to the online privacy of all our users and we comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).
1. Who we are
The data controller is Spectra Clinic, 22 Seymour Street, Mayfair, London W1H 7HY. [PLACEHOLDER: registered company name and number]. [PLACEHOLDER: ICO registration number - register and pay the data protection fee at ico.org.uk]. Data protection contact: hello@spectra-clinic.com.
2. What personal data we collect and why
| What | Why we use it | Lawful basis | How long we keep it |
|---|---|---|---|
| Name, e-mail, subject and message from the contact form or chat enquiry | To reply to your enquiry | Legitimate interests (answering enquiries) / steps before a contract | Up to 3 years after our last contact, then anonymised |
| E-mail address and your e-mail preferences (newsletter sign-up) | To send you our newsletter, offers and updates you asked for | Consent (you can withdraw it at any time) | Until you unsubscribe; then only a suppression record |
| Name, e-mail, phone, delivery address, order details (shop) | To process and deliver your order, accounting and refunds | Contract; legal obligation (tax records) | 6 years for transaction records, then personal details are wiped |
| Product review (name, e-mail, review text) | To publish genuine reviews | Consent | Until you ask us to remove it |
| Cookie choices (anonymous visitor reference, choices, date) | To prove and respect your cookie consent | Legal obligation (PECR) | Up to 6 years |
| Website analytics (only if you accept analytics cookies) | To understand and improve our website | Consent | Up to 14 months |
All personal data you send us through forms is encrypted at rest. We never store card details - payments are made on Stripe's secure page.
3. Who we share your data with
We only share data with service providers (processors) who act on our instructions and are bound by data processing agreements, listed below. We never sell your data and we do not share it with anyone for their own marketing.
| Processor | Purpose | Country | Transfer safeguard |
|---|---|---|---|
| Stripe Payments Europe, Ltd. | Card payments for shop orders (PCI DSS Level 1) | Ireland / USA | UK adequacy regulations / UK Addendum to EU SCCs |
| Resend | Sending transactional and newsletter e-mail | USA | UK International Data Transfer Addendum / EU SCCs |
| Google (Google Analytics) - only with your consent | Website analytics | USA | UK Extension to the EU-US Data Privacy Framework / UK IDTA |
| PartnerMe AI (hosting and website platform) | Hosting the website and database | [PLACEHOLDER: hosting country] | [PLACEHOLDER: transfer safeguard if outside the UK / EEA] |
| Treatwell (online booking) | If you book through the booking button you are using Treatwell's own service and privacy notice | UK / EEA | Separate controller |
4. International transfers
Where a provider is based outside the UK we rely on UK adequacy regulations, the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, so your data keeps an equivalent level of protection.
5. Your rights
You have the right to access your data (a copy of it), to have it corrected or erased, to restrict or object to processing (including direct marketing), to data portability, and to withdraw consent at any time. To use any of these rights, e-mail hello@spectra-clinic.com. Every marketing e-mail contains an unsubscribe link and a link to manage your e-mail preferences. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
6. Children
Our website is not aimed at children. You must be 16 or over to use our forms, subscribe to our newsletter or place an order, and we ask you to confirm this. If we learn that we hold data about a child under 16 without a parent's consent we will delete it.
7. Security
We protect your data with encryption at rest (AES-256), encrypted connections (HTTPS), strong access controls, two-factor authentication for administrators, rate limiting and activity logging. If a personal data breach puts your rights at risk we will tell you and the ICO within the legal time limits.
8. Cookies
See our Cookie Policy for details and to change your choices at any time using the "Cookie settings" link in the footer.
9. Changes to this policy
We may update this policy from time to time. The latest version is always on this page.