Legal

Privacy policy

What we collect, why, and what you can ask us to do about it.

Last updated 29 October 2026

1. In short

This website uses no advertising cookies, and it only uses analytics if you agree to it (see section 7). Visitors don’t need an account or a login. You only give us personal details if you choose to — for example to book, to ask for a reminder, or to apply for a job. We do not build a profile of you when you browse.

The personal data we hold is almost entirely the information you give us when you book a treatment, and the notes we are required to keep for your safety.

2. Who we are

Benito Brow Bar is a trading name of Benito Brow Bar Stores Ltd, a company registered in England and Wales (company number 07826345), registered office Kings Court Business Centre, 17 School Road, Hall Green, Birmingham B28 8JG. We are the data controller for the personal data described in this policy.

Contact us about anything in this policy at info@benitobrowbar.com, or call your brow bar (numbers on our Locations page).

3. The law we work to

We handle personal data in line with the UK GDPR, the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (PECR).

4. What we collect

When you book a treatment — your name, contact details, the treatment booked and the brow bar you are visiting.

When you have a skin or patch test — the date of the test, the result, and any allergy or skin sensitivity you tell us about. This is special category health data and is treated with extra care. We hold it because we cannot safely treat you without it.

When a technician logs your visit at one of our brow bars — your name, the service you had, the brow bar you visited, the technician who treated you, your skin-test result where the treatment needs one, and an email address or mobile number (or both) so we can contact you about your appointments and your safety and, only if you choose, send you offers and news. This is entered by our staff, not a public form — it replaces a paper appointment book. For a tint, lash lift or lamination we also record the skin test (when it was done, where on the skin, the product and shade, who did it, and the earliest time you can be treated), that you had no reaction since, the product used and how long it was left on, any reaction, the safety questions you answered (including any health condition we advised you about and your decision to go ahead), your age band (and, for under-16s, your parent or guardian’s name), and that you ticked our declaration. Why we hold it is in section 5, who sees it in section 6, and how long we keep it in section 8.

When you ask us to remind you when you’re due — your name, email address, the brow bar, the treatments you had and the date of your visit, so we can email you a reminder.

When you apply for a job with us — see section 13.

When you email, call or message us — your message and contact details, so we can reply.

When you browse this site — our host keeps standard server logs, including IP address, for security and diagnostics. These are not used to identify or track you.

5. Why we hold it, and on what basis

To provide the treatment you booked — performance of a contract.
To keep your treatment and skin-test record, including any reaction. Skin-test results and reactions are health information, which the law treats as special category data. While you are a client we use the record to give you your treatment safely (performance of a contract). We keep it afterwards because we have a legitimate interest in being able to show we looked after you properly, and the health information may be needed to establish or defend a legal claim (UK GDPR Article 9(2)(f)). The box you tick at the brow bar is a declaration that your answers are correct, kept as part of that record. It is not a consent you need to give, or can withdraw, for us to keep the record.
To answer your enquiry — legitimate interest in responding to you.
To send a reminder you asked for — your consent. Ask us to stop at any time.
To consider a job application — see section 13.
To meet accounting and insurance obligations — legal obligation.
To contact you about your appointments and your safety. For example, a change to a booking or something about your skin test. This is part of looking after you (performance of a contract, and our legitimate interest in treating you safely), so it isn’t marketing and doesn’t need a tick.
To send you offers and news (marketing) — only with your consent, which you can withdraw at any time. At the brow bar you can tick to say yes by email, by text message or both, or tick “No thanks” to stop. The boxes are never ticked for you, and if you leave them blank we don’t change the choice you made before (if you’re new, that means no offers). We never use your skin-test or health information for marketing.

6. Who else sees it

We do not sell your data, and we do not share it for anyone else’s marketing.

Booking providers. When you book through John Lewis, your booking is handled on John Lewis’ systems under their privacy policy. Where we use a booking platform for direct bookings, it processes your data on our instructions.
Our host. This website is hosted in the UK.
Our internal client record. Visits logged by our staff are stored in our customer directory on Square, the booking and payments platform we use. Square processes this data on our instructions under its standard data processing terms. A back-up copy is kept in our Google Workspace (below), so a record is not lost if Square is unavailable. Square is run by Block, Inc. and may process data outside the UK, including in the United States, under the approved safeguards in its data processing terms. The client record page is behind a staff login. A look-up shows staff only your first name, surname initial and skin-test details, and never your contact details. Only our technicians, through that page, and the business owners, in Square and Google, can see these records.
Google Workspace. Our business email and file storage are provided by Google. Reminder requests, job applications and a back-up copy of visits logged by our technicians, including skin-test results, are held there, on our instructions.
Google Analytics and Microsoft Clarity — only if you accept analytics cookies. Google Analytics (Google Ireland Ltd) counts visits, the pages viewed and where visitors came from. Microsoft Clarity (Microsoft Ireland Operations Ltd) shows how pages are used — clicks, scrolling and mouse movement — so we can see what is confusing and fix it. Anything typed into a form is hidden from Clarity. We have switched off advertising and Google signals in both, and we use the reports only to improve this website. Both providers may process data in the United States under the UK–US data bridge or an approved safeguard.
Adobe Fonts. This site loads its typefaces from Adobe’s font service, which means your IP address is seen by Adobe when a page loads. This happens on every page, before you make any choice in the cookie banner, because the site needs the fonts to display its text.
Where the law requires it — for example a court order.

7. Cookies

Analytics: only with your consent. When you first visit, we ask what you’re happy with. You can accept all, reject all, or tap Manage preferences to choose each type on its own. Nothing is set unless you say yes, and the switches always start off.

Analytics (Google Analytics) sets _ga and _ga_… to count visits and the pages viewed. They last 13 months.
Visit insights (Microsoft Clarity) sets _clck (1 year) and _clsk (1 day) to link the pages viewed in one visit and show where people click and scroll.

We use no advertising cookies. You can change your mind at any time with Cookie settings at the foot of every page. When you switch a type off, its cookies are deleted.

What we store without asking. Your browser remembers your cookie choice for 6 months, so we don’t ask on every page, and that you have already seen our short film during this visit, so it doesn’t open again. Both are kept only on your device and are never sent to us.

8. How long we keep it

Skin and patch test records, and any reaction note. Kept for 6 years after your last visit, then deleted. If you were under 18 at your last visit, we keep them until your 21st birthday if that is later. We keep them this long in case of a claim about a treatment.
Booking and treatment history, including visits logged by a technician. Kept for 6 years after your last visit, on the same terms as above. The back-up copy of a logged visit in our Google Workspace is removed after 90 days, once it is safely in Square.
Accounting records — 6 years, as tax law requires.
Marketing consent — until you withdraw it. We also stop marketing if you haven’t visited for 2 years.
Job applications — 6 months from the date you apply, then deleted automatically (see section 13).
Emails and reminder requests — kept only as long as needed to deal with the matter.

9. Where it is held

Your data is held in the UK or the European Economic Area wherever possible. If any provider we use stores data elsewhere, we make sure an approved safeguard is in place, such as the UK International Data Transfer Agreement.

10. Your rights

Under UK GDPR you have the right to:

be told how your data is used — this page;
ask for a copy of the data we hold about you;
have inaccurate data corrected;
ask us to delete data, where we have no continuing reason to keep it. A treatment or skin-test record that may still be needed for a possible claim is kept until the end of the period in section 8 (UK GDPR Article 17(3)(e)); we’ll tell you if that applies;
ask us to restrict how we use it;
object to us using it on the basis of legitimate interest;
receive your data in a portable format;
withdraw consent at any time;
not be subject to a decision made solely by automated means that significantly affects you. We do not make any.

Email info@benitobrowbar.com and we will respond within one month. There is no charge.

11. Complaints

You have the right to complain to us about how we handle your personal data. Email info@benitobrowbar.com, call your brow bar (numbers on our Locations page), or contact us any other way you like. We will acknowledge your complaint within 30 days, look into it properly, keep you updated, and tell you the outcome without undue delay.

You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put things right first.

12. Children

We treat under-16s only with the consent of a parent or guardian, who must be present. We record the parent or guardian’s name and their declaration, and otherwise hold no more data about a young client than we would for an adult. Records of anyone treated under 18 are kept until their 21st birthday if that is later than 6 years after their last visit.

13. Applying to work with us

This section covers you if you apply for a job or register your interest in working with us, through our online form, by email, or by Instagram or Facebook message.

What we collect

your name and contact details, and any social media profiles you choose to share;
the roles, brow bar and hours you are interested in, your experience and skills, and anything else you tell us;
your CV, if you send one, and what is in it;
your answer to whether you have the right to work in the UK;
when you applied, and which page you applied from.

Please leave out anything we do not need to judge your application, such as your date of birth, marital status, health or religion.

Why we use it, and on what basis

To consider your application and contact you about it — taking steps at your request before a possible contract of employment.
To keep you in mind for other suitable roles for up to 6 months — your consent, which you give on the form and can withdraw at any time.
To check your right to work in the UK if we offer you a job — legal obligation.
To make adjustments to our process if you tell us about a disability — our obligations under employment and equality law. We use this information for nothing else.

Who sees it

Only the people at Benito involved in hiring. Your application is stored in our business email and file storage (Google Workspace, see section 6). If you apply by Instagram or Facebook message, Meta also processes that message under its own privacy policy. We never sell or share your application with anyone else.

How decisions are made

A person reads every application. No decision about you is made by automated means.

How long we keep it

We keep your application for 6 months from the date you apply, then delete it automatically. Email us to have it deleted sooner. If we offer you a job, we will ask to see documents proving your right to work in the UK, and the law requires us to keep a copy while you work for us and for 2 years afterwards. If you join us, your application becomes part of your staff record, and we will explain how we look after staff data.

14. Changes

If this policy changes we will update the date at the top. Where a change matters to you, we will tell you.