Privacy policy

This website is run by Lily Brunning, a sole trader based in the United Kingdom. I am the controller of the personal information described here. For any privacy question or request, email lily@lilybrunning.com.

This policy covers the whole of lilybrunning.com, including the salon and beauty service page and the Found, Chosen, Booked product page. It explains what I collect, why, who else is involved, how long it is kept and your rights under the UK GDPR and the Data Protection Act 2018.

• Website enquiries. When you use an enquiry form I receive your name, email address and what you tell me. Depending on the form, that can include your phone number, business name, town or city, how you work, the service or package you are interested in, your website or social media links, and your message. I use this to reply, arrange an intro call and prepare a proposal. Lawful basis: legitimate interests in responding to people who contact me, and steps you ask me to take before entering into a contract.
• Correspondence and client work. If we exchange emails or work together, I keep the correspondence and the information needed to deliver and invoice the work. Lawful basis: performance of a contract, and legal obligations such as tax and accounting records.
• Found, Chosen, Booked purchases. Payhip runs the checkout and delivers the files. Through Payhip I receive purchase details such as your name, email address, what you bought, the amount, date, order reference, approximate location for tax purposes and, if asked at checkout, any answers you give. I do not receive your full card number or security code; these go to the payment processor. I use this to confirm your access, handle support, refund and cancellation questions, apply any agreed service credit and keep sales records. Lawful basis: performance of a contract and legal obligations.
• Purchase and service messages. Order confirmations, download emails and replies about your purchase or project are necessary messages. They are separate from promotional email and are sent whether or not you join a mailing list.
• Promotional email. If you tick the marketing tips and offers box on an enquiry form, your name and email address are added to my mailing list, which is run through MailerLite. The box is never pre-ticked, and making an enquiry, buying a product or accepting terms will never count as agreeing to marketing. You can unsubscribe at any time from any marketing email, or by emailing me. Lawful basis: your consent.
• Optional analytics. If you accept analytics cookies, Google Analytics 4 records how pages are used, such as pages viewed, approximate location, device type and clicks on key buttons like booking links or sending an enquiry. No form contents are sent to analytics. It does not load unless you choose it. Lawful basis: your consent, which you can withdraw through Cookie preferences in the footer. See the cookie policy.
• Technical and security data. The hosting platform processes standard request information such as IP address, browser and time of request to deliver the site and protect it from misuse. Lawful basis: legitimate interests in running a secure website.

Please do not include sensitive information, such as health details, in messages to me.

I do not sell personal information. It is shared only with the providers needed to run the site and the business:

• Lovable (website hosting, database for enquiry forms and the email service that forwards enquiries to my inbox), acting on my behalf. Lovable privacy policy.
• Payhip (checkout and digital delivery for Found, Chosen, Booked). Payhip acts on my behalf in delivering the sale, and also uses information as an independent controller for its own purposes such as running its platform, legal compliance and fraud prevention. Payhip privacy policy.
• Stripe and PayPal (payment processing through Payhip, depending on how you pay). They handle your card or account details and act as independent controllers for payment, legal and fraud-prevention purposes. Stripe privacy policy, PayPal privacy statement.
• Google (Google Analytics 4, only with your consent). Google privacy policy.
• MailerLite (sends marketing emails to people who have opted in, and stores their name, email address and consent record). MailerLite privacy policy.
• My email provider, and professional advisers such as an accountant where needed.

Some of these providers, or their own suppliers, process information outside the UK, including in the United States. Where that happens, the transfer relies on safeguards recognised under UK law, such as UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework where a provider is certified) or the UK International Data Transfer Addendum to standard contractual clauses. Each provider's privacy policy, linked above, describes the arrangement it uses.

• Enquiries that do not lead to work are deleted within 12 months of our last contact.
• Client project records, purchase records and invoices are kept for up to 6 years after the end of the relevant tax year, to meet UK tax and accounting obligations and to deal with any claims.
• Your cookie choice is stored in your browser for up to 12 months.
• Mailing list details are kept until you unsubscribe, plus a short period afterwards to honour the unsubscribe request.
• Google Analytics data is kept according to the retention setting on my Google Analytics account, and no longer than Google's maximum for standard properties. Payhip, Stripe and PayPal keep their own records under their own policies.

Depending on the circumstances, you have the right to:

• access a copy of your personal information;
• have inaccurate information corrected;
• have information deleted or its use restricted;
• object to processing based on legitimate interests, and object to direct marketing at any time;
• receive information you gave me in a portable format;
• withdraw consent at any time, without affecting anything done before.

To use any of these rights, email lily@lilybrunning.com. If you are unhappy with how I have handled your information, please tell me first so I can try to put it right. You can also complain to the Information Commissioner's Office at ico.org.uk.

Cookie policy · Service terms

I may update this policy when tools or services change. The date at the top always shows the latest version.