1. Who is responsible for your information
Katie Walsh - Facial Aesthetics Clinic (KW Facial Aesthetics Ltd, company number 15731141, Freemantle House, Freemantle Road, Lowestoft, NR33 0EA) is the controller of the personal information collected through this booking page. Contact us about your data on 01502 349481. Our ICO registration reference is .
The page and the messages you receive are run for us by Canguro Media AB, a Swedish marketing agency that acts on our instructions as a processor (see section 4).
2. What we collect
- Contact details: first name, last name, mobile number, email address.
- Suitability answers: your answers to the three short questions on the page. Answers about pregnancy, medication and skin conditions are health information.
- Analysis results: the photographs taken by the skin analyser, the scores and report it produces, and the notes your practitioner makes. These are health information.
- Booking details: the appointment you chose, changes to it, and whether you attended.
- Payment status: whether your payment succeeded, the Stripe payment reference and, if relevant, whether money was returned. We never receive or store your card number.
- Messages: texts and emails you send us in reply, and our replies.
- Technical information: IP address, device and browser type, pages viewed, and advertising identifiers set by cookies where you have allowed them (see section 9).
3. Why we use it and our legal basis
| Purpose | Information used | Legal basis (UK GDPR) |
|---|---|---|
| Taking your booking, holding your appointment and processing your payment | contact, booking, payment status | Performance of a contract (Article 6(1)(b)) |
| Carrying out your skin analysis and advising you on it | suitability answers, analysis photographs, scores and notes | Your explicit consent for health information (Article 9(2)(a)), given when you submit the form and again at your appointment |
| Texting and emailing you about this booking: confirmation, reminders, changes, how to prepare | contact, booking | Performance of a contract (Article 6(1)(b)) |
| Following up if you started but did not complete a booking, and about the same service afterwards | contact, booking, payment status | Our legitimate interest in completing and following up the enquiry you made (Article 6(1)(f)), using the soft opt-in in the Privacy and Electronic Communications Regulations 2003. Reply STOP or use the email link to stop at any time |
| Sending you offers about other treatments at the clinic | contact | Your consent, given by ticking the optional box (Article 6(1)(a)). Withdraw it any time |
| Asking you to review us after your visit | contact, booking | Legitimate interest in feedback (Article 6(1)(f)) |
| Measuring whether our advertising works (Meta pixel and Conversions API) | technical information, hashed email and mobile number | Consent for cookies and similar technologies where required; legitimate interest in measuring advertising (Article 6(1)(f)) for the server-side measurement |
| Understanding how the page is used (Microsoft Clarity) | technical information | Consent for cookies (see section 9) |
| Keeping records, handling complaints and disputes, meeting legal obligations | all of the above | Legal obligation (Article 6(1)(c)) and legitimate interest in defending claims (Article 6(1)(f)) |
We do not use your information for automated decisions with legal or similar effects. The skin analyser produces scores and images, and your practitioner reviews and interprets them with you. It does not decide anything about you on its own.
4. Who we share it with
We use these providers, who process your information on our behalf and only on our instructions:
- Stripe Payments UK Ltd (payment processing). Stripe also uses payment information for its own fraud prevention and legal compliance, for which Stripe is a separate controller. See stripe.com/gb/privacy.
- Canguro Media AB, Sweden (operates the booking page, the booking system and the text and email messaging on our behalf, through its Canguro Core platform).
- Vercel Inc., USA (hosts the booking page).
- Twilio, through Canguro Core (delivers text messages).
- Meta Platforms Ireland Ltd (advertising measurement). Meta is an independent controller for its own uses of the data it receives. See facebook.com/privacy/policy.
- Microsoft Ireland Operations Ltd (Microsoft Clarity page analytics), where enabled.
- Google Ireland Ltd (the map on the page).
Your analysis photographs and report stay with the clinic and are not shared with any of the advertising or analytics providers above.
We may also share information where the law requires it, with our insurer or legal adviser in the event of a claim, and with a successor if the clinic is sold. We never sell your information.
5. International transfers
Canguro Media AB stores your information in the European Economic Area, which the UK recognises as providing adequate protection. Where a provider processes information in the United States (Vercel, Twilio, Meta, Microsoft), the transfer is covered by the UK International Data Transfer Agreement or Addendum, or by the UK Extension to the EU-US Data Privacy Framework where the provider is certified. Contact us for details of the safeguard that applies to a specific provider.
6. How long we keep it
| Information | Kept for |
|---|---|
| Analysis records, reports, consultation notes and payment records for appointments that went ahead | 6 years after the appointment (limitation period for legal claims and tax records), or longer if a professional register requires it |
| Enquiries and bookings that did not go ahead | 12 months after the last contact from you |
| Marketing consent and opt-out records | For as long as we send marketing, plus 2 years, so we can show what you agreed to. Opt-outs are kept indefinitely so we do not contact you again |
| Messages | 2 years |
| Technical and analytics information | Up to 13 months (cookie lifetimes), or aggregated so it no longer identifies you |
7. Your rights
You have the right to ask for a copy of your information, to have mistakes corrected, to have it deleted, to restrict or object to how we use it, to receive it in a portable format, and to withdraw any consent you have given. You have an absolute right to object to direct marketing.
Contact us on 01502 349481 to use any of these rights. We reply within one month. We may ask you to confirm your identity first.
8. Marketing choices
- Reply STOP to any marketing text and we stop texting you marketing.
- Use the unsubscribe link in any marketing email.
- Tell us on 01502 349481 and we stop all marketing to you.
Messages about a booking you have made (confirmations, reminders, changes) are not marketing and continue for as long as you have an appointment with us.
9. Cookies and similar technologies
The page uses strictly necessary cookies to make the booking work. It also uses advertising (Meta) and analytics (Microsoft Clarity) technologies. Where your consent is required for these, we ask for it before they are set.
10. Complaints about how we use your information
Contact us first on 01502 349481. You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, 0303 123 1113, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
11. Changes
We update this notice when our practices change. The version date is at the top.