Last updated: September 2026
MegsLocks (“we”, “us”, “our”) takes your privacy seriously. We’re not selling your details to random firms, spamming you with nonsense, or doing anything sketchy with your hair pics. This page tells you what we do collect, why, and what you can do about it.
1. Who’s responsible for your data?
Data controller: Megan Greene, trading as MegsLocks (sole trader). That’s Meg — not a faceless tech giant in California.
- Studio: Bear Ink Society Tattoo Studio, 24 Milnrow Road, Manchester
- Email: megs@megslocks.co.uk
- Phone: 07863 835418
Privacy questions, access requests, or “what have you got on me?” — use the details above. We’ll get back to you properly, not with a copy-paste bot reply.
2. What data we collect
Depends how you use us. We might collect:
- Identity & contact: name, email, phone number, delivery/billing address
- Bookings: service chosen, date/time, notes you leave, booking reference, payment status for booking fees
- Shop orders: what you bought, order history, delivery details, payment confirmation (we don’t store full card numbers — that’s Stripe’s job)
- Enquiries: hair type, style preferences, photos you upload, and whatever you write in the form
- Technical stuff: IP address, browser type, device info, cookies (see section 8)
- Messages: emails, form submissions, and call records when you contact us
We don’t routinely collect special category data (health info and the like). Only share what’s relevant to your hair — we don’t need your entire life story unless it affects your appointment.
3. What we do with it
We use your data to actually run the business — not to build a creepy dossier. Specifically:
- Process and deliver shop orders
- Manage appointments, bookings, cancellations and booking fees
- Respond to enquiries and quote bespoke work
- Send service emails — confirmations, reminders, order updates (the useful stuff, not spam)
- Keep the website working and improve how it runs
- Meet legal and tax obligations — HMRC exists, unfortunately
- Keep our systems secure and prevent fraud
4. Why we’re allowed to (legal bases)
Under UK GDPR, we need a lawful reason. Ours are:
- Contract — you booked or bought something; we need your details to deliver it
- Legitimate interests — running the business, keeping the site secure, improving services (balanced against your rights — we’re not being grabby for the sake of it)
- Consent — where you’ve opted in (marketing emails, portfolio photos of your hair)
- Legal obligation — tax records, consumer law, that sort of thing
5. Who we share data with
- Website & hosting — CritiCall Ops Ltd (UK/EU infrastructure)
- Payments — Stripe (or similar when card payments are live); bank details for booking fees only as needed to complete payment
- Email — our hosting provider to send transactional messages
- Spam protection — Akismet on forms, where enabled
These providers process data on our instructions and must protect it properly. We may also have to disclose data if the law requires it — we’re not going to fight a court order with a witty comeback.
6. Data leaving the UK
We aim to keep data in the UK or EEA. If any processor stores data elsewhere, we make sure proper safeguards are in place (UK adequacy regulations, standard contractual clauses — the official paperwork).
7. How long we keep it
We don’t hoard your data forever. Typical retention:
- Orders: up to 6 years — tax and accounting, boring but required
- Appointments & bookings: usually up to 3 years after your last visit, unless we need longer for disputes or legal reasons
- Enquiry photos & messages: until the enquiry’s closed, or up to 2 years if you become a client
- Marketing consent: until you opt out or we no longer need it
- Server logs: typically up to 90 days
When we don’t need it anymore, we delete or anonymise it. Your hair pics aren’t sitting in a drawer for eternity.
8. Cookies
Small files on your device. Ours include:
- Essential cookies — shop cart, checkout, secure login (WooCommerce session stuff). Can’t run the shop without them.
- Preference cookies — remember choices like staying logged in
- Security cookies — protect forms and admin access
We don’t use third-party advertising cookies tracking you round the internet. You can control cookies in your browser — turn off essential ones and checkout might sulk.
9. Marketing & portfolio photos
Marketing emails only if you’ve opted in. Unsubscribe any time — link in the email or drop us a message. No hard feelings.
We might ask to photograph your hair for portfolio or social media. Only with your explicit consent. Your head, your call — and you can withdraw consent whenever you like.
10. Your rights
UK law gives you proper rights. You can:
- Access — ask what data we hold about you
- Rectification — get mistakes fixed (wrong email, typo in your name, etc.)
- Erasure — ask us to delete your data in certain circumstances
- Restrict processing — ask us to limit how we use your data
- Data portability — get your data in a structured, machine-readable format where it applies
- Object — object to processing based on legitimate interests or direct marketing
- Withdraw consent — where we’re relying on consent
Email megs@megslocks.co.uk to exercise any of these. We’ll respond within one month — usually sooner if we’re not elbow-deep in dreads.
Not happy with how we’ve handled things? You can complain to the Information Commissioner’s Office (ICO): ico.org.uk/make-a-complaint. That’s your right — we won’t hold it against you.
11. Security
We take reasonable steps to protect your data:
- HTTPS encryption on the website
- Secure hosting with access controls
- Encrypted passwords for admin accounts
- Card payments handled by PCI-compliant providers — not stored on our servers
- Regular updates and security hardening
No system is 100% bulletproof. Use a strong password if you create an account — “password123” won’t cut it, and you know that.
12. Children
Our services aren’t aimed at under-16s. Clients under 16 need a parent or guardian to book and consent to any treatment. Same rules as the studio — children only attend if they’re booked in for a service.
13. Changes to this policy
We may update this policy from time to time. The current version lives on this page with the date above. Big changes might get an email or a notice on the site. Worth a quick re-read now and then — we’ll try not to make it worse.
14. Related policies
Terms & Conditions · Refund & Returns Policy
Privacy request? Email megs@megslocks.co.uk and we’ll sort it.