Last updated: September 2026
MegsLocks (“we”, “us”, “our”) is committed to protecting your privacy. This policy explains what personal data we collect when you use megslocks.co.uk, our online shop, booking system, or contact us — and your rights under UK data protection law (UK GDPR and the Data Protection Act 2018).
1. Who is responsible for your data?
Data controller: Megan Greene, trading as MegsLocks (sole trader)
- Studio: Bear Ink Society Tattoo Studio, 24 Milnrow Road, Manchester
- Email: megs@megslocks.co.uk
- Phone: 07863 835418
For privacy questions or to exercise your rights, contact us using the details above.
2. What data we collect
Depending on how you use our services, we may collect:
- Identity & contact: name, email address, phone number, delivery/billing address
- Booking & appointments: service chosen, appointment date/time, notes you provide, booking reference, payment status for booking fees
- Shop orders: products purchased, order history, delivery details, payment confirmation (we do not store full card numbers — payments are processed by our payment provider)
- Enquiries: hair type, style preferences, photos you upload, and messages in enquiry forms
- Technical: IP address, browser type, device information, and cookies (see section 8)
- Communications: emails, messages, and call records where you contact us
We do not routinely collect special category data (e.g. health information). Please only share what is relevant to your hair appointment or order.
3. How we use your data
We use your personal data to:
- Process and fulfil online shop orders and deliveries
- Manage appointments, bookings, cancellations and booking fees
- Respond to enquiries and provide quotes for bespoke services
- Send service-related emails (confirmations, reminders, order updates)
- Improve our website and customer experience
- Comply with legal and tax obligations
- Prevent fraud and protect the security of our systems
4. Legal bases for processing
Under UK GDPR, we rely on:
- Contract — to provide services you book or products you buy
- Legitimate interests — to run our business, improve our services, and keep our site secure (balanced against your rights)
- Consent — where you opt in (e.g. marketing emails, portfolio photos of your hair)
- Legal obligation — where we must keep records for tax or consumer law
5. Who we share data with
We do not sell your personal data. We may share it with trusted processors who help us run the business, including:
- Website & shop hosting — CritiCall Ops Ltd (server infrastructure in the UK/EU)
- Payment processing — Stripe or similar (when card payments are enabled); bank details for booking fees are shared only as needed to complete your payment
- Email delivery — our email/hosting provider to send transactional messages
- Spam protection — Akismet (Automattic) on comment/contact forms, where enabled
These providers only process data on our instructions and must protect it appropriately. We may also disclose data if required by law or to protect our legal rights.
6. International transfers
We aim to keep data in the UK or EEA. If any processor stores data outside the UK, we ensure appropriate safeguards (such as UK adequacy regulations or standard contractual clauses) are in place.
7. How long we keep data
- Orders: up to 6 years for tax and accounting purposes
- Appointments & bookings: typically up to 3 years after your last visit, unless longer retention is needed for disputes or legal obligations
- Enquiry photos & messages: until your enquiry is closed, or up to 2 years if you become a client
- Marketing consent: until you withdraw consent or we no longer need it
- Server logs: typically up to 90 days
We delete or anonymise data when it is no longer needed.
8. Cookies
Our website uses cookies — small files stored on your device. These include:
- Essential cookies — required for the shop cart, checkout, and secure login (e.g. WooCommerce session cookies)
- Preference cookies — remember choices such as staying logged in
- Security cookies — help protect forms and admin access
We do not use third-party advertising cookies. You can control cookies through your browser settings; disabling essential cookies may affect shop checkout and booking.
9. Marketing & portfolio photos
We will only send marketing emails if you have opted in. You can unsubscribe at any time using the link in any email or by contacting us.
We may ask to photograph your hairstyle for our portfolio or social media. We will only do so with your explicit consent, and you can withdraw consent at any time.
10. Your rights
You have the right to:
- Access — request a copy of the personal data we hold about you
- Rectification — ask us to correct inaccurate data
- Erasure — ask us to delete your data in certain circumstances
- Restrict processing — ask us to limit how we use your data
- Data portability — receive your data in a structured, machine-readable format where applicable
- Object — object to processing based on legitimate interests or for direct marketing
- Withdraw consent — where processing is based on consent
To exercise any of these rights, email megs@megslocks.co.uk. We will respond within one month.
You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint
11. Security
We use appropriate technical and organisational measures to protect your data, including:
- HTTPS encryption on the website (when live)
- Secure hosting with access controls
- Encrypted passwords for admin accounts
- Payment card data handled by PCI-compliant payment providers — not stored on our servers
- Regular software updates and security hardening
No method of transmission over the internet is 100% secure. Please use a strong, unique password if you create an account.
12. Children
Our services are not directed at children under 16. Clients under 16 must have a parent or guardian book on their behalf and provide consent for any treatment.
13. Changes to this policy
We may update this policy from time to time. The current version will always be on this page with the date above. Significant changes may be notified by email or a notice on the website.
14. Related policies
Terms & Conditions · Refund & Returns Policy
Questions? Contact us.