Version 1.2 | Effective date: 12 October 2026
Who we are
At The Refinery, we are committed to protecting your privacy and handling your personal information with care, transparency and respect.
This Privacy Notice explains how we collect, use, store, protect and share your information when you contact us, make an appointment, purchase products or receive services.
The Refinery is responsible for the personal information described in this notice. The Wax Room @ The Refinery operates under the same privacy arrangements.
We process personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable data protection legislation.
The Refinery | 106A Connaught Road, Fleet, Hampshire, GU51 3QX | hello@therefineryfleet.co.uk
Our relationship with Defined & Co
The Refinery uses Defined & Co hair systems, products, methodology and professional standards.
Information collected through The Refinery may also be used for relevant Defined & Co functions, including membership administration, hair system allocation, technical support, product concerns, manufacturing faults, safety investigations, complaints and the Confidence Guarantee.
Only information reasonably necessary for these purposes will be used or shared with the relevant authorised personnel or service providers.
The Refinery remains the primary client-facing contact for appointments, consultations, treatments, service records and related enquiries.
1. Information we collect
We collect and process personal information necessary to provide our services, manage our business, meet legal obligations and maintain appropriate client records. Depending on how you interact with us, this may include:
Personal and contact information: Your name, address, telephone number, email address, date of birth and communication preferences.
Appointments and transactions: Enquiries, bookings, appointment history, services received, retail purchases, payment records, deposits, refunds and related correspondence. Payment card transactions are handled through authorised payment providers. We do not store your full payment card details.
Consultation and treatment information: Consultation forms, suitability assessments, consent records, treatment history, service notes, aftercare instructions, patch-test results and information relevant to your ongoing care.
Health and sensitive information: Relevant information concerning medical conditions, medication, allergies, sensitivities, scalp or skin conditions, contraindications and other health considerations necessary to assess suitability and deliver treatments safely.
Photographs and technical records: Photographs documenting hair, scalp or skin conditions, treatment progress, technical assessments or concerns relating to a product or service. Photographs taken for consultation, treatment or technical records are separate from marketing permissions and will not automatically be used for promotional purposes.
Marketing and media permissions: Optional consent records relating to photographs, video, audio, testimonials, marketing communications and signed model releases.
CCTV: Images recorded by security cameras covering the studio entrances and immediate access points. CCTV does not record audio.
Other information: Correspondence, complaints, incidents, product concerns, manufacturing fault evidence, relevant Defined & Co support information and information required to meet legal or insurance obligations.
2. Why we collect and use your information
We process personal information only where we have a lawful basis under UK data protection law. The lawful basis depends on why the information is required and how it is being used.
| Purpose | Usual lawful basis |
|---|---|
| Manage enquiries, bookings, appointments, payments and purchases | Contract or steps requested before entering into a contract |
| Assess treatment suitability and provide services | Contract, legitimate interests and an applicable special-category condition where required |
| Maintain consultation, treatment, consent and aftercare records | Contract, legitimate interests, legal obligations and an applicable special-category condition where required |
| Investigate complaints, incidents and product concerns | Legitimate interests, legal obligations and establishment, exercise or defence of legal claims |
| Administer relevant Defined & Co functions | Contract, legitimate interests, legal obligations or consent, depending on the purpose |
| Maintain accounting, taxation, insurance and regulatory records | Legal obligations and legitimate interests |
| Protect premises and investigate security incidents through CCTV | Legitimate interests |
| Use optional photographs, videos or testimonials for marketing | Consent and applicable model-release permissions |
| Send promotional and marketing communications | Consent or another lawful electronic-marketing route |
| Maintain and improve our services and business operations | Legitimate interests, subject to appropriate safeguards |
Our legitimate interests
Where we rely on legitimate interests, these may include managing our business, maintaining accurate records, supporting clients, investigating concerns, protecting our premises, preventing misuse of services, improving operational standards and establishing or defending legal claims.
We consider the necessity of the processing and balance our legitimate interests against your rights and freedoms.
Health and special-category information
Certain treatments require us to collect relevant health information so that we can assess suitability, identify potential contraindications and provide services safely.
Health information is classified as special-category personal data and receives additional protection under UK data protection law.
Where we process this information, we rely on an appropriate lawful basis and an additional special-category condition, normally your explicit consent or, where applicable, another condition recognised by law, including the establishment, exercise or defence of legal claims.
We collect only information reasonably necessary for the relevant purpose and restrict access to authorised personnel.
If you choose not to provide information necessary for a suitability assessment, we may be unable to confirm that a treatment is appropriate or safely provide the requested service.
3. Where your information comes from
Most personal information is provided directly by you when you contact us, complete forms, make appointments, purchase products or receive services. We may also receive relevant information from:
- Parents or legal guardians where appropriate.
- Vagaro and our booking, payment or communication providers.
- Consultation and treatment records.
- CCTV and security systems.
- Defined & Co functions or another Approved Partner where lawful support, administration or continuity of care requires it.
- Insurers, professional advisers or other authorised sources where necessary for a legitimate or legal purpose.
We will only collect information from other sources where there is an appropriate lawful basis for doing so.
4. How your information is stored and protected
Protecting your personal information is important to us.
We use appropriate technical and organisational measures designed to safeguard information against unauthorised access, disclosure, alteration, loss or destruction. These include, where appropriate:
- Secure business and booking systems.
- Password-protected accounts and multi-factor authentication.
- Restricted access based on operational responsibilities.
- Secure cloud storage and trusted third-party providers.
- Device protection and controlled information sharing.
- Locked premises and secure physical storage.
- Appropriate retention and secure deletion procedures.
Personal information is accessible only to authorised individuals who require it for an approved business purpose.
Although no electronic system can be guaranteed completely secure, we regularly consider the safeguards necessary to protect the information entrusted to us.
5. How long we keep your information
We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including service delivery, client support, insurance, legal obligations and the resolution of complaints or claims. Our normal retention arrangements are:
| Information | Normal retention |
|---|---|
| Client, consultation, treatment, consent, complaint and incident records | Seven years after the client relationship or relevant matter ends |
| CCTV recordings | 30 days, unless footage must be preserved for a specific incident, investigation or legal purpose |
| Marketing permissions and model releases | While the relevant content remains in use and for an appropriate evidential period afterwards |
| Unsuccessful enquiries with no continuing relationship | Up to 12 months |
| Financial and accounting records | Normally six years after the relevant accounting period |
Records may be retained longer where reasonably necessary to meet a legal obligation, insurance requirement, safeguarding concern or to establish, exercise or defend legal claims.
Where permission for future marketing or promotional use is withdrawn, we will stop further use covered by that withdrawal and retain only records necessary to demonstrate how permissions were managed or to meet another lawful requirement.
Once information is no longer required, we securely delete or anonymise it.
Where information has been effectively anonymised so that individuals can no longer reasonably be identified, it may be used for lawful business purposes, including quality assurance, training, statistical analysis and service improvement.
6. Who we share your information with
We do not sell your personal information.
We may share relevant information with trusted providers, professional advisers or authorities where reasonably necessary and permitted by law. Depending on the circumstances, these may include:
- Defined & Co functions supporting membership administration, hair system allocation, technical investigations, product safety, manufacturing concerns and client support.
- Vagaro and other authorised booking, communication and payment providers.
- Secure IT, cloud storage and business system providers.
- Ring and relevant security service providers.
- Accountants, insurers, legal advisers and other professional advisers.
- Manufacturers or suppliers involved in investigating product concerns.
- Medical or emergency services where necessary and lawful.
- Regulators, law enforcement agencies or other authorities where required or permitted by law.
Only information reasonably necessary and proportionate to the relevant purpose will be shared.
Information used within the Defined & Co framework
The Refinery may use or make relevant client information available through the wider Defined & Co framework where reasonably necessary to administer memberships, coordinate hair system orders, maintain continuity of care, investigate product concerns, administer applicable guarantees or meet legal and contractual responsibilities.
The relevant information will be limited to what is required for the specific purpose.
Information collected for The Refinery's consultations and treatments will not automatically become available to the wider Approved Partner network.
Where information is shared with another independently operated Approved Partner, this will take place only where there is an appropriate lawful basis and a genuine operational reason to do so.
7. International processing
Some of our trusted technology and service providers may process or store personal information outside the United Kingdom.
Where this occurs, we ensure an appropriate legal basis for the transfer and suitable protections are in place.
These may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses or another lawful transfer mechanism recognised under UK data protection law.
8. Photographs, videos and marketing permissions
We may take technical photographs where necessary to document consultations, treatment progress, relevant conditions or concerns relating to a product or service.
These photographs form part of the relevant client or treatment record and are not automatically available for marketing use.
Separate permission is required where we wish to use identifiable photographs, videos, audio recordings or testimonials for promotional, educational or other optional content purposes.
Where applicable, these permissions are recorded through our consent and model-release arrangements.
You may withdraw consent for future processing that relies on your consent by contacting us.
Withdrawal does not make earlier lawful processing unlawful. Where content has already been published or distributed, we will manage requests in accordance with the applicable permissions, legal requirements and practical circumstances.
Marketing communications
We may contact you about services, products, offers or business updates where permitted under applicable data protection and electronic-marketing legislation.
Where consent is required, we will obtain it before sending promotional communications.
You may opt out at any time through an unsubscribe option, where available, or by contacting us directly.
Opting out of marketing will not prevent us from sending necessary appointment, treatment, transaction or other service-related communications.
9. CCTV and studio security
CCTV operates at The Refinery to support the security of clients, staff, visitors and our premises.
Cameras cover studio entrances and immediate access points. CCTV does not record audio.
Recordings are used only for legitimate security, incident investigation, crime prevention or related legal purposes.
CCTV footage is normally retained for 30 days. Relevant footage may be preserved for longer where necessary for a specific incident, investigation, insurance matter or legal requirement.
Access is restricted to authorised individuals and footage will only be disclosed where there is a lawful and appropriate reason.
10. Your data protection rights
Under UK data protection law, you have rights concerning how your personal information is handled. Depending on the circumstances, these include the right to:
- Request access to personal information held about you.
- Request correction of inaccurate or incomplete information.
- Request deletion of information where applicable.
- Request restriction of processing in certain circumstances.
- Object to certain types of processing.
- Request the transfer of your information where applicable.
- Withdraw consent where processing relies on consent.
These rights are not absolute. Certain information may need to be retained to meet legal, insurance, safeguarding or other lawful requirements.
To exercise your rights, please contact hello@therefineryfleet.co.uk.
We normally respond within one month of receiving a valid request, subject to any applicable statutory extension or other legal provision.
We may request proportionate information to confirm your identity, authority or the scope of the request where reasonably necessary.
11. Data protection complaints
If you have any concerns about how we have handled your personal information, please contact us so that we can investigate the matter.
You do not need to use legal language or complete a particular form to raise a complaint.
We will acknowledge a data protection complaint within 30 days of receipt, begin appropriate enquiries without undue delay and explain the outcome without undue delay.
Where an investigation takes longer, we will keep you informed as appropriate.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent data protection regulator.
In most cases, the ICO will expect you to raise the matter with us first so that we have an opportunity to address it.
Further information is available at www.ico.org.uk.
12. Children and safeguarding
Our services are primarily intended for adults.
Waxing services delivered through The Wax Room @ The Refinery are available only to clients aged 18 or over.
Where services are provided to someone under 18, we follow appropriate suitability, consent and safeguarding arrangements.
We collect and process information relating to children only where there is an appropriate lawful basis, including parental or guardian involvement where required.
Where information has been collected inappropriately, we will take reasonable steps to correct or delete it in accordance with applicable law.
13. Automated decision-making
The Refinery does not make decisions about clients based solely on automated processing or profiling that produce legal or similarly significant effects.
Decisions relating to treatment suitability, client services, complaints, product concerns and ongoing support involve appropriate human review.
14. Changes to this Privacy Notice
We may update this Privacy Notice to reflect changes in our services, business operations, technology providers, information-sharing arrangements or legal obligations.
The current approved version will apply from its stated effective date.
Where appropriate, we will notify clients of significant changes using a suitable communication method.
15. Contact us
If you have any questions about this Privacy Notice, your personal information or how we process your data, we're here to help.
The Refinery
106A Connaught Road
Fleet, Hampshire, GU51 3QX
Email: hello@therefineryfleet.co.uk
Website: www.therefineryfleet.co.uk