Privacy notice

How OokySpooky looks after the information you give us on your consent form.

Who we are

OokySpooky is a body piercing studio run by Vincent Gare. We are the "data controller" for your information.

Address

(to be confirmed)

Email

(to be confirmed)

Phone

(to be confirmed)

ICO registration

(to be confirmed)

What we collect

• Your name, date of birth, mobile number, email and address.
• The piercing or piercings you are having.
• Health information you give us: conditions you tick, anything you tell us about blood, nervous system or skin conditions, and allergies.
• Your answers to the consent statements, and your signature.
• If you are under 18: your parent or guardian's name and signature.
• Whether you agree to photos of your piercing being used, and your signature for that.
• A scrambled (one-way hashed) version of your internet address and your browser type, so we can show when and how the form was signed.
• If you book an appointment: your name, mobile and email (or those of the person booking for you), the date and time, what it's for, and your date of birth if you give it. No health information is kept with a booking.

Why we use it

• To pierce you safely. We need your health information to decide whether the piercing is safe for you, and your age to make sure it is legal and whether a parent must consent. This is part of providing the service you've asked for.
• To keep a record of your consent. Our insurer and licensing rules expect us to keep signed consent records, and we may need them if there is ever a question about your piercing.
• Health information is a special category of data. We only collect it with your explicit consent, which you give with the separate tick box on the form. If you don't give it, we can't go ahead with the piercing.
• We will contact you only about your appointment and aftercare, including a reminder the day before your appointment and a reminder to book your follow-up check if you haven't. We never use your details for marketing unless you separately agree, and we never sell them.

Who can see it

Only OokySpooky's piercing staff, each with their own password-and-code login. Your health answers and signatures are encrypted, and every time a form is opened it is recorded.

Your information is stored on our server: (to be confirmed). The company that hosts it cannot read your encrypted health answers or signatures.

If we text you a link to your form, your mobile number and the message are passed to our text message provider, The SMS Works Ltd, which sends it for us. We keep only the last three digits of the number with the record of the text, and whether it was delivered. The same applies to appointment reminders.

If we email you a link to your form, we send it from our own server, not through an email company. With the record of the email we keep only the first letter of your address and its domain, for example s•••@gmail.com.

If you use "Find your address" on the form, what you type in that box (and nothing else from the form) is sent to our address-lookup provider, Postio, to find matching addresses. It is processed in the UK.

If you book online, you pay the deposit on Square's own secure page (Square is part of Block, Inc.). Your card details go to Square, never to us: we only learn that the deposit was paid. Square also sends you a receipt and keeps its own record of the payment under its privacy notice.

Our piercers can see the appointment diary in their own calendar app (Google Calendar). That copy holds only what the appointment is for, the time, your first name and the initial of your surname: never your contact details or anything else.

We would only share your information with others if the law required it, for example with our insurer or a court if there were a claim.

How long we keep it

• If you have the piercing: 7 years from the day your form is completed.
• If you were under 18: until your 18th birthday plus 7 years, if that is later.
• If you don't go ahead: 90 days, then it is deleted.
• Appointment bookings: 24 months after the appointment date. An online booking whose deposit was never paid: 90 days.
• Deposit records (amount, date and booking reference, for our accounts): 6 years.

Records are deleted automatically when these periods end.

Your rights

You can ask us for a copy of the information we hold about you, to correct it, or to delete it. You can also object to how we use it or ask us to limit it. Email (to be confirmed) and we will reply within one month.

You can withdraw your consent to photos at any time. You can also withdraw your consent to us holding your health information, but we may need to keep your completed consent record for the period above, because the law allows us to keep records we need to defend legal claims. We'll explain what applies if you ask.

If you're unhappy with how we've handled your information, please tell us first. You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, or 0303 123 1113.