Privacy Policy

Who we are

Born is operated by Paul Heaton, a sole trader trading as Born. Paul is the data controller, responsible for deciding how your personal information is used. Born provides makeup services, makeup lessons, photography experiences and wig refurbishment.

Email paul@born.uk.com or contact Paul on 07872 822884.

We handle personal information under applicable UK data protection law, including the UK GDPR and the Data Protection Act 2018, as amended. Contact Paul using the details above for privacy questions, requests or complaints.

Information we use

Depending on your enquiry or service, we may use:

• Your name, email address and telephone number.
• Your preferred appointment date and time, chosen services, messages and booking correspondence.
• An address where needed to provide an agreed service, return a wig or keep required financial records.
• Photographs you send us or that are created as part of your photography service, and information about your permission to publish photographs.
• Marketing preferences and records needed to respect them.
• Technical information associated with website requests and spam protection, such as IP address and browser information.

Information normally comes directly from you. If someone contacts Born to arrange a service for you, we may also receive relevant contact or booking information from them.

Born does not maintain client medical records or separate notes about allergies, skin conditions or other health matters. Please avoid including unnecessary sensitive information in a general enquiry.

Enquiries and bookings

The booking form asks for your name, email address, telephone number, preferred date and time, selected services and an optional message. Required fields are marked. Without the required details, we cannot process that form; you can contact Paul directly instead.

When online enquiries are enabled, the website processes your submission and uses Brevo to email it to paul@born.uk.com. Client correspondence is stored within Born’s Microsoft email service. The booking application does not create a customer account or a separate enquiry database.

The wig enquiry form sends your name, email address, selected service and message directly to Born. Cloudflare Turnstile checks the submission for spam, and Brevo delivers the enquiry to Born’s email inbox. We use the details to respond to your enquiry and arrange any agreed service. If photographs are needed, please send them separately by email to paul@born.uk.com.

Submitting an enquiry does not confirm an appointment or subscribe you to marketing. Paul will respond personally about availability and booking arrangements, as explained in the Terms of Use and Cancellation Policy.

Why we use information

• Service enquiries and bookings: to take steps at your request before a contract, or to fulfil our contract with you.
• General correspondence, handling concerns and website security: our legitimate interests in running Born, responding to people and preventing abuse, balanced against your privacy rights.
• Required financial and business records: to comply with legal obligations.
• Photographic archive: our legitimate interest in maintaining Born’s archive of final retouched photographs, balanced against your privacy rights. Archive retention does not itself give permission for marketing use.
• Publishing identifiable client photographs for marketing: your consent for the agreed uses.
• Optional marketing emails and website analytics: your consent.

Client photographs and permission

Client photographs and relevant files are stored in Dropbox and on an external hard drive. Born does not use Pixieset.

Permission to publish client photographs is obtained verbally, by email or through messages. Once permission is given, the relevant photograph folder is marked “Approved to make public”. Not every permission is recorded in writing.

With permission, photographs may be used on the Born website and in marketing, including social media, within the uses agreed with you. Booking a service does not itself give permission to publish your photographs.

You can withdraw permission for future use by contacting Paul. Withdrawal does not make earlier use unlawful. We will stop new uses covered by that permission and address existing uses on channels we control. We cannot guarantee the removal of material already distributed, or copies published or shared independently by third parties.

You can also contact Paul to ask about the photographs we hold and exercise any applicable data protection rights.

Marketing emails

Born uses Brevo for marketing emails and maintains its own marketing list, separate from Eunoa Digital. You are added only when you agree to receive Born marketing communications.

A booking or enquiry does not automatically subscribe you. Service correspondence about an enquiry or booking is separate from marketing.

You can unsubscribe using the link in a marketing email or by contacting Paul. This will not stop necessary correspondence about an existing booking. We may retain the minimum information needed to respect your unsubscribe request.

Service providers and sharing

We use the following services where relevant to the way you interact with Born:

• Microsoft: email hosting and storage of client correspondence.
• Dropbox: storage of client photographs and relevant files.
• Brevo: Born marketing emails and delivery of website booking enquiries when configured.
• Cloudflare: website hosting and security, including Turnstile spam protection when online enquiries are enabled.

The booking system uses an IP-based rate limit to reduce abuse. When Turnstile is enabled, technical browser signals are checked and an IP address may be sent for verification. The booking form content is sent through Brevo for email delivery, rather than to Turnstile as form content.

Information may also be disclosed where required by law. Publishing an approved photograph on a website or social media makes that photograph available to other people under the agreed permission.

These providers may process information outside the UK, including in the United States. The applicable protections depend on the provider and service, such as UK adequacy arrangements or approved contractual safeguards. Contact Paul for details of the processing locations and transfer arrangements relevant to your information.

Provider privacy information: Microsoft, Dropbox, Brevo, Cloudflare and the Turnstile Privacy Addendum.

Website services, analytics and cookies

Website services

The pages load Google Fonts from Google, and the homepage loads a YouTube thumbnail. These requests can share technical connection information with Google. Choosing to play the BBC video loads a YouTube player using its privacy-enhanced domain. The player then operates under Google’s privacy arrangements; “privacy-enhanced” does not mean that no information is processed.

Cloudflare provides hosting and security. Its Turnstile spam protection is designed to load when the booking system is configured and available. External services may use cookies or similar technologies depending on their operation and settings. See Google’s Privacy Policy and Cloudflare’s privacy information above.

Cookie choices and analytics

On born.uk.com, CookieYes displays the cookie banner and remembers your choices. You can accept optional cookies, reject them or choose categories under Customise. Essential website functions, including spam protection for enquiries, remain available regardless of your analytics choice.

If you allow Analytics cookies, Born uses Google Analytics 4 to understand how people find and use the website, including which pages they visit. Google receives information about page visits, how visitors arrived and the device or browser they use. Analytics stays off until you choose to allow it.

• cookieyes-consent: an essential cookie that remembers your choices for up to one year.
• _ga: an optional analytics cookie that distinguishes browsers, with a default lifetime of up to two years.
• _ga_FDPCCQH9QK: an optional analytics cookie that remembers the session state, with a default lifetime of up to two years.

To change your choice, reopen the cookie banner using its cookie icon or the Cookie settings button below. Turn off Analytics and save your preferences, or choose Reject all. This stops further Google Analytics tracking.

Cookie settings

See CookieYes’s Privacy Policy and how Google uses information from websites that use its services. Other websites reached through links have their own privacy information.

How long we keep information

• Final retouched client photographs: retained indefinitely as part of Born’s photographic archive, subject to applicable privacy rights. You can ask us to consider deletion or object to continued retention. Keeping a photograph in the archive does not authorise its publication.
• RAW photographs: reviewed and deleted periodically as part of file housekeeping.
• Booking enquiries and related email correspondence: retained for 12 months, then deleted, subject to any overriding legal requirement.

Financial records needed for statutory purposes are kept for the period required by the relevant law. This is separate from the 12-month correspondence policy and does not mean that all emails are retained for a financial record-keeping period.

Other records, such as marketing preferences and evidence of permission, are kept for as long as needed for their purpose, to respect your choices or to meet a legal requirement. Service providers’ own technical records and deletion processes may also apply. Contact Paul if you would like information about a particular record.

Keeping information secure

The business Mac is password-protected. Born’s Microsoft and Dropbox accounts use two-factor authentication. Client correspondence is held in Microsoft email, while photographs and relevant files are stored in Dropbox and on an external hard drive.

The website uses HTTPS. The booking code includes validation and, when configured, spam protection and rate limiting. These measures help protect information, but no computer, email or storage system can provide absolute security.

Your data protection rights

Depending on the circumstances and lawful basis, you may ask us to:

• Give you access to your personal information.
• Correct inaccurate or incomplete information.
• Delete information.
• Restrict how information is used.
• Provide certain information in a portable form.

Your right to object: you can object to processing based on legitimate interests. You can object to direct marketing at any time.

Where we rely on consent, you can withdraw it at any time. Use the cookie settings for website analytics or contact Paul for other uses. Withdrawal does not affect the lawfulness of processing before it was withdrawn.

These rights are subject to the conditions and exceptions in data protection law. We may need reasonable information to verify your identity. We will normally respond to rights requests within one calendar month, subject to any lawful extension or pause.

Decisions about appointment availability and confirmation are made personally by Paul, rather than by an automated booking decision.

Privacy complaints

If you are concerned about our use of personal information, contact Paul at paul@born.uk.com or using the details above. We will acknowledge a data protection complaint within 30 days, investigate it, keep you informed and respond without undue delay.

You also have the right to complain to the Information Commissioner’s Office. Visit ico.org.uk/make-a-complaint.

Changes to this policy

We will update this policy when our practices or legal requirements change. The date at the top shows the latest update. If a new use of information requires a separate notice or permission, we will provide it.