Privacy Policy

When you book a session with us, we collect:

• Your name: so we know who the booking is for.
• Your email address: to send you booking confirmations and reminders.
• Your phone number: so we can reach you about your booking if we need to.
• Your booking note (optional): the booking form has an “Anything we should know?” box you can use to tell us anything helpful before your visit. If you choose to include health or accessibility information in it, such as allergies or access needs, we use it only to prepare for your session. Your note is stored with your booking record and is visible only to our team.
• Refund records: if we refund all or part of a booking, we keep a record of what we refunded, how and why. If your reason involves your health, we note only what we need, and only our admins can see it.

We use this information only to process your booking and to communicate with you about it. We don't use it for marketing unless you've separately agreed to that. If you accept advertising cookies, we also send your email address and phone number to Google when you pay, to measure our ads (see Advertising cookies below).

When you pay, your card details are collected and processed directly by our payment provider, Stripe. We never see or store your full card details.

If you choose Accept on our cookie banner, we use the Meta Pixel and the Google tag on our website. If you choose Decline, or don't choose, we don't use either of them.

The Meta Pixel is a tool from Meta Platforms, Inc., the company behind Facebook and Instagram. When it runs, it collects:

• the pages you visit on our site
• when you pay for a booking on our website, and how much you paid
• details about your device and browser
• your IP address
• the identifiers stored in the _fbp and _fbc cookies

We only tell Meta the amount you paid at checkout. Any part covered by a gift voucher or discount code isn't included, and if a gift voucher or discount code covers the whole booking, we don't tell Meta about it at all. We don't send Meta your name, email address or phone number.

Meta may link this information to your Facebook or Instagram account if you have one.

We use it to measure how our ads perform and to personalise them, for example by showing our ads to people who have visited our site. Our lawful basis for this is your consent.

We and Meta are joint controllers for collecting this data on our site and sending it to Meta. Once Meta has it, Meta is a separate controller and decides how to use it, including for its own advertising. Meta's Privacy Policy explains what Meta does with the data and how to exercise your rights with Meta.

The Google tag is a tool from Google LLC, which runs our ads on Google. When it runs, it collects:

• the pages you visit on our site
• whether you came to our site from one of our Google ads
• when you pay for a booking on our website, how much you paid, and Stripe's reference for that payment
• details about your device and browser
• your IP address
• the identifiers stored in the _gcl_ cookies

When you pay for a booking, we also send Google your email address and, if you gave us one, your phone number. Google turns them into a scrambled code (a one-way hash) and uses it to match your booking to a Google account that saw or clicked one of our ads. As with Meta, we only tell Google the amount you paid at checkout, and if a gift voucher or discount code covers the whole booking, we don't tell Google about it at all. We don't send Google your name.

Google may link this information to your Google account if you have one.

We use it to measure how our ads perform and to personalise them, for example by showing our ads to people who have visited our site. Our lawful basis for this is your consent.

For your email address and phone number, Google is our processor: it uses them to measure our ads on our behalf. For everything else the Google tag collects, Google is a separate controller and decides how to use it, including for its own advertising. How Google uses information from sites that use its services explains what Google does with the data, and Google's Privacy Policy explains how to exercise your rights with Google.

You can withdraw your consent at any time with Cookie settings at the bottom of our pages. Our Cookie Policy has more detail.

Under UK GDPR we need a lawful basis to process your data. We rely on three:

• Contract: we need your details to take your booking and send your confirmations and reminders, which is how we deliver the session you've paid for.
• Legitimate interests: we keep booking records for a reasonable time to run the business properly: handling queries, refunds and our own record-keeping. We've weighed this against your rights and keep only what we need.
• Consent: we only use advertising cookies, and share the data they collect with Meta and Google, if you choose Accept on our cookie banner. You can withdraw your consent at any time.

We keep booking records for 2 years from the date of your session, after which we securely delete them. We may keep certain information longer where the law requires it, for example, financial records we need for tax purposes.

If you accept advertising cookies, the _fbp, _fbc and _gcl_ cookies last up to 90 days in your browser. We don't keep the Meta Pixel or Google tag data ourselves. How long Meta and Google keep it is explained in Meta's Privacy Policy and Google's Privacy Policy.

We never sell your data. If you accept advertising cookies, Meta and Google use the data the Meta Pixel and the Google tag collect for their own advertising as well as ours (see Advertising cookies above). Otherwise, we don't share your data for anyone else's marketing.

We use a few trusted service providers (our “data processors”) to run the business, and they handle your data to do their job for us, on our instructions, except where we say otherwise below:

• Supabase: securely stores our booking database (hosted in the EU).
• Stripe: processes your payment securely.
• Resend: sends your booking confirmation and reminder emails, and delivers our internal booking notification, which includes any note you added.
• Vercel: hosts our website and provides our cookieless, anonymous visit statistics.
• Cloudflare: runs the Turnstile bot check on our booking and gift voucher forms. Cloudflare also uses the technical data from this check to improve its bot detection, and decides how it does that itself.

Each of these providers is GDPR compliant and is contractually required to keep your data safe. They use it only for the service they provide to us, except that Cloudflare also uses the bot check data to improve its bot detection, as described above.

Meta Platforms, Inc. is not one of our processors. If you accept advertising cookies, we and Meta are joint controllers for collecting data through the Meta Pixel and sending it to Meta, and Meta is a separate controller for how it uses that data afterwards. See Advertising cookies above.

Google LLC is our processor only for the email address and phone number we send it when you pay, if you accept advertising cookies. For the rest of the data the Google tag collects, Google is a separate controller. See Advertising cookies above.

Our booking database is stored in the European Union, in Supabase's EU West region. Some providers, such as Stripe, Resend, Vercel and Cloudflare, may process limited data on servers outside the UK and EU; where they do, it's protected by safeguards approved under UK data protection law (such as Standard Contractual Clauses).

If you accept advertising cookies, the data the Meta Pixel collects goes to Meta Platforms, Inc. in the United States. Meta relies on approved safeguards for this, such as the UK-US data bridge. The data the Google tag collects, and the email address and phone number we send Google, go to Google LLC in the United States, which relies on the same kind of safeguards.

To be completely clear: we never sell, rent or trade your personal information to anyone.

Under UK GDPR you have the right to:

• Access: ask for a copy of the personal data we hold about you.
• Rectification: ask us to correct anything that's wrong or incomplete.
• Erasure: ask us to delete your data (the “right to be forgotten”).
• Portability: ask for your data in a common, machine-readable format so you can reuse it elsewhere.
• Withdraw consent: where we rely on your consent, such as for advertising cookies, you can withdraw it at any time with Cookie settings. This doesn't affect how we used your data before you withdrew it.

You can also ask us to restrict or object to how we use your data.

Just email us at seasidesplatter@gmail.com. There's no charge, and we'll respond within one month. We may need to confirm your identity first, so we don't hand your data to the wrong person.

Our website uses a few essential cookies to work properly. If you choose Accept on our cookie banner, we also use advertising cookies from Meta and Google. You can change your choice at any time with Cookie settings. You can read more in our Cookie Policy.

If you're unhappy with how we've handled your data, please contact us first at seasidesplatter@gmail.com so we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk.

We may update this policy from time to time. The “last updated” date at the top shows when it last changed.

Seaside Splatter
49 Norfolk Square, Brighton and Hove BN1 2PA
Email: seasidesplatter@gmail.com
Website: seasidesplatter.co.uk