Privacy Policy

When you book a session with us, we collect:

• Your name - so we know who the booking is for.
• Your email address - to send you booking confirmations and reminders.
• Your phone number - so we can reach you about your booking if we need to.

We use this information only to process your booking and to communicate with you about it. We don't use it for marketing unless you've separately agreed to that.

When you pay, your card details are collected and processed directly by our payment provider, Stripe. We never see or store your full card details.

Under UK GDPR we need a lawful basis to process your data. We rely on two:

• Contract: we need your details to take your booking and send your confirmations and reminders, which is how we deliver the session you've paid for.
• Legitimate interests: we keep booking records for a reasonable time to run the business properly: handling queries, refunds and our own record-keeping. We've weighed this against your rights and keep only what we need.

We keep booking records for 2 years from the date of your session, after which we securely delete them. We may keep certain information longer where the law requires it, for example, financial records we need for tax purposes.

We never sell your data, and we don't share it for anyone else's marketing. We use a few trusted service providers (our “data processors”) to run the business, and they only handle your data to do their job for us, on our instructions:

• Supabase - securely stores our booking database (hosted in the EU).
• Stripe - processes your payment securely.
• Resend - sends your booking confirmation and reminder emails.

Each of these providers is GDPR compliant and is contractually required to keep your data safe and use it only for the service they provide to us.

Our booking database is stored in the European Union, in Supabase's EU West region. Some providers, such as Stripe and Resend, may process limited data on servers outside the UK and EU; where they do, it's protected by safeguards approved under UK data protection law (such as Standard Contractual Clauses).

To be completely clear: we never sell, rent or trade your personal information to anyone.

Under UK GDPR you have the right to:

• Access - ask for a copy of the personal data we hold about you.
• Rectification- ask us to correct anything that's wrong or incomplete.
• Erasure- ask us to delete your data (the “right to be forgotten”).
• Portability - ask for your data in a common, machine-readable format so you can reuse it elsewhere.

You can also ask us to restrict or object to how we use your data.

Just email us at seasidesplatter@gmail.com. There's no charge, and we'll respond within one month. We may need to confirm your identity first, so we don't hand your data to the wrong person.

Our website uses a small number of cookies to work properly and to understand how the site is used. You can read more in our Cookie Policy.

If you're unhappy with how we've handled your data, please contact us first at seasidesplatter@gmail.com so we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk.

We may update this policy from time to time. The “last updated” date at the top shows when it last changed.

Seaside Splatter
49 Norfolk Square, Brighton and Hove BN1 2PA
Email: seasidesplatter@gmail.com
Website: seasidesplatter.co.uk