The General Data Protection Regulation (GDPR), which came into force on 25 May 2018, protects and enhances the rights of individuals (data subjects) in relation to information which is collected about them. These rights cover the safeguarding of personal data, protection against the unlawful processing of personal data and the unrestricted movement of personal data within the EU. It should be noted that GDPR does not apply to information already in the public domain.
We are committed to ensuring that your privacy is protected. We will comply with the GDPR, along with any national implementing laws, regulations and secondary legislation in the UK, including (without limitation) the Data Protection Act 2018 (DPA).
We are the data controller (as defined in the DPA) of information you provide to us. We determine the purposes for which, and the manner in which, any of your personal data is, or is to be, processed. Our Clinic Manager is our data privacy manager who is responsible for overseeing questions in relation to this Privacy Policy. If you have any questions about this Privacy Policy, including requests to exercise your legal rights, please contact the Clinic Manager using the details set out in the Complaints and contact details section below.
This Privacy Policy, together with our Cookie Policy (a copy of which can be found here) sets out:
• how we collect personal information from you; and
• how that the personal information you provide will be processed by us.
By visiting any part of our website or any other website belong to Skintique Clinic, you accept and consent to our collection, use and retention of your personal information upon the terms of this Privacy Policy. If you do not agree to any part of this Privacy Policy and do not wish to provide such consent, please cease to use our website(s) and do not submit any personal information to us.
Why we collect personal data
We collect personal information in order to provide and tailor our services and products to our clients and potential clients. We will use the information collected from you in order to provide quotations, and to make contact with you (by telephone, email, SMS message, through social media messaging platforms and by post) in order to provide you with information regarding our products and services either in which you have expressed an interest, or which we believe will be of interest to you as a client or potential client of Skintique Clinic.
We may from time to time use such information to identify our website visitors; we may also collect statistics about the behaviour of visitors to our website(s).
In addition, we may use your personal information to identify and prevent fraud, to enhance the security of our computer network and information systems, and to identify the effectiveness of promotional campaigns or advertising.
Giving and withdrawing your consent
When you make initial contact with us, you consent to Skintique Clinic opening and maintaining a sales dialogue with you until you either opt out from receiving communications with us (which you can do at any stage) or until we decide to desist in promoting our services. We can also obtain consent to processing your personal data by you agreeing in writing (including by email) to be bound by the terms of this Privacy Policy. If we obtain consent from you to do so, we will also send you promotional marketing emails.
You have the right to withdraw your consent to the processing of your personal data at any time or if you prefer not to receive promotional marketing messages from us. Please let us know by contacting us:
• by emailing info@skintiqueclinic.com ; or
• using the contact details listed at the bottom of this Privacy Policy; or
• by clicking on the unsubscribe option in any marketing email we send to you,
and we will ensure that your information is deleted as soon as reasonably practicable.
Our websites use cookies. A cookie is a string of information that a website stores on a visitor’s computer or mobile device, and that the visitor’s browser provides to the website each time the visitor returns. If you do not wish to have cookies placed on your computer or mobile device, you should set your browser settings to refuse cookies before using any of our websites.
How we collect personal data
Personal data may be collected about you from the forms and surveys you complete (either electronically, online or on paper and including (but not limited to) medical and other questionnaires provided by us), from records of our correspondence and telephone calls, and from details of your visits to our website (including but not limited to personally identifying information like Internet Protocol (IP) addresses).
Disclosure of personal data to third parties
Skintique Clinic does not sell, trade or pass on information gained from your engagement with us to any other party without your consent. We may, however, disclose your personal information if we are required to do so in order to meet our legal obligations, regulatory requirements or in response to a valid governmental request. We may also disclose your personal information if we are required to do so in order to enforce our contractual rights against you (under our terms and conditions of business or otherwise), including: investigating potential breaches of those terms and conditions; to detect, prevent or mitigate fraud or security or technical issues; or to protect against imminent harm to the rights, property or safety of Skintique Clinic, our other clients and/or the wider community.
If you register for our GoCardless prepayment scheme, we will share your personal information with GoCardless Ltd, the third party facilitator of the scheme, which is a company registered in England with number is 10540938 whose registered office is at Sutton Yard, 65 Goswell Road, London, England, EC1V 7EN (GoCardless). GoCardless is authorised by the Financial Conduct Authority under the Payment Services Regulations 2017, registration number 597190, for the provision of payment services. GoCardless will be a data controller in relation to your personal data. Their processing and storage of your information will be determined in accordance with GoCardless’s global privacy notice, which is available at https://gocardless.com/legal/privacy/ , and not this privacy policy.
Legal basis for processing any personal data
We request and process your personal data in order to meet our contractual obligations to you (including the assessment of the suitability of any treatment(s) for you), and also to provide you with newsletters and informational emails relating to our services and products.
Data storage
We store your personal data using cloud-based technology provided by a UK-registered external third party service provider, and therefore your personal data is shared with them. This may involve transferring your data outside the European Economic Area (EEA). Such countries do not have the same data protection laws as the United Kingdom and EEA. Whilst the European Commission may not have given a formal decision that such countries provide an adequate level of data protection similar to those which apply in the United Kingdom and EEA, any transfer of your personal information will be subject to such legally enforceable mechanism(s) for transfers of personal data as may be permitted under the General Data Protection Regulation that are designed to help safeguard your privacy rights and give you remedies in the unlikely event of a misuse of your personal information.
If you would like further information as to the safeguards we have in place in relation to international transfers of data, please contact our Clinic Manager (see the Complaints and contact details section below).
Data security
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
What information do we store?
Information is collected from you when you complete any enquiry form on our website, where you have requested (via the website or in person) that we send you marketing information, or when you complete any forms or questionnaires in person or online in relation to the provision of our services to you. The information which you provide to us may include (but not be limited to):
• your name;
• your email address;
• your postal address / location;
• your telephone number(s);
• your medical history and any other information pertinent to you receiving services from us.
Retention Policy
We will retain your personal information whilst we are corresponding with you or providing services to you. We will retain this information until you tell us that you no longer want to hear from us, or:
• up to 5 years if we do not provide any treatment to you; and
• if we provide any treatment to you, up to 10 years from the date of the last treatment provided to you,
whichever is the longer. These time periods have been recommended to us by our insurers.
Your rights as a data subject
At any point whilst we are in possession of or processing your personal data, you have the following rights in relation to your personal information held by us:
• a right of access: you have the right to request a copy of the information that we hold about you;
• a right of rectification: you have a right to correct data that we hold about you that is inaccurate or incomplete;
• the right to be forgotten: in certain circumstances you can ask for the data we hold about you to be erased from our records;
• the right to restriction of processing: where certain conditions apply you have a right to restrict our processing of your personal information;
• the right of portability: you have the right to have the data we hold about you transferred to another organisation;
• a right to object: you have the right to object to certain types of processing such as direct marketing;
• the right to object to automated processing, including profiling: you have the right not to be subject to the legal effects of automated processing or profiling.
In the event that we refuse your request under rights of access, we will provide you with a reason as to why, which you have the right to legally challenge.
In response to a request by you, we can confirm what information we hold about you and how it is processed.
You can request the following information from us:
• the identity and the contact details of the person or organisation appointed by us that has determined how and why to process your data;
• the contact details of the person responsible for data protection at Skintique Clinic, where applicable;
• the purpose of the processing as well as the legal basis for processing;
• if the processing is based on the legitimate interests of Skintique Clinic;
• the categories of personal data collected, stored and processed;
• the identity of the recipient(s) or categories of recipients that the data is/will be disclosed to;
• how long the data will be stored;
• details of your rights to correct, erase, restrict or object to such processing;
• information about your right to withdraw consent at any time;
• how to lodge a complaint with the supervisory authority (Data Protection Regulator);
• whether the provision by you of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether you are obliged to provide the personal data and the possible consequences of failing to provide such data.
• The source of personal data if it wasn’t collected directly from you.
• Any details and information of automated decision making, such as profiling, and any meaningful information about the logic involved, as well as the significance and expected consequences of such processing.
To access the personal data we hold about you, identification will be required
We will accept the following forms of ID when you request information relating to the personal data held by us:
• a copy of the photo page of your passport, national ID card or driving licence; and
• a utility bill not older than three months.
A minimum of one piece of photographic ID listed above and a supporting document is required. If Skintique Clinic is dissatisfied with any identification document provided by you or the quality of any part of it, further information may be sought by us before personal data can be released.
All requests should be made to info@skintiqueclinic.com , by telephoning 0116 270 0123 or by writing to us at the address further below.
You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.
Complaints and contact details
In the event that you wish to make a complaint about how your personal data is being processed by us, you have the right to complain to our Clinic Manager. We will respond to all legitimate requests within 30 days. In addition, you have the right to make a complaint at any time to the data protection regulator which is the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues. We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.
The details for each of these contacts are:
The Clinic Manager
The Clinic Manager
Skintique Clinics Limited
342 Welford Road
Leicester
LE2 6EH
Email: info@skintiqueclinic.com
The Information Commissioner’s Office
Contact details are at: www.ico.org.uk/global/contact-us
This Privacy Policy was last updated on 4 April 2019.