[Bespoke Salon] (“we”, “us”, “the Salon”) operates [https://bespokesalon.in] and the salon and academy located at 1st Floor, 196, Turner Rd, above P.C. Chandra Jewellers, Bandra West, Mumbai, Maharashtra 400050, India.

This policy explains what personal information we collect, why we collect it, who we share it with, and the choices you have.

We are the Data Fiduciary for this information under the Digital Personal Data Protection Act, 2023 and the rules made under it.

If anything here is unclear, contact us using the details at the end of this page. We would rather explain it than have you guess.

1. Information We Collect

When You Book or Visit Us

• Name, mobile number, email address
• Date of birth or birth month, if you choose to share it
• Gender, where relevant to service selection
• Appointment history: services taken, dates, stylist, duration
• Amounts billed, payment method used, membership or package balances

Service and Treatment Records

• Colour formulations, developer volumes, processing times, and previous colour history
• Hair and scalp observations recorded by your stylist
• Allergies, sensitivities, and patch test results
• Any medical information you volunteer that affects a service — for example pregnancy, recent medication, or a skin condition

We record this because chemical services are not safe without it. It is kept for your protection and is only seen by staff involved in your service.

Photographs and Images

• Before-and-after photographs of hair and styling work
• Video of services, where recorded

We only photograph you with your permission, and we ask separately before using any image publicly. See Section 5.

Payments

Payments are processed by Razorpay. We receive confirmation that a payment succeeded, the amount, and the last four digits of the card where applicable. We do not store your full card number, CVV, UPI PIN, or net banking credentials.

Messaging

• WhatsApp number and message history with our business account
• Delivery and read status of messages we send
• Call records where you contact the salon by phone

Website and Advertising

• Pages viewed, time on site, referring source
• Device type, browser, approximate location derived from IP address
• Information you submit through enquiry or booking forms
• Cookies and similar technologies, including the Meta Pixel and Google Analytics

Advertising Enquiries

If you submit an enquiry through an advertisement on Facebook or Instagram, we receive the name, phone number, email address, and any answers you provide in that form. Meta’s own handling of that information is governed by Meta’s privacy policy.

Academy Applicants and Students

If you apply to or enrol in our academy, we additionally collect educational background, identity documents required for enrolment, course attendance, assessment records, and fee payment history.

CCTV

Our premises are monitored by CCTV for the safety of clients and staff. Footage covers common areas and entrances. It is not recorded in changing areas or washrooms.

2. Why We Collect It

Purpose	What It Covers
Delivering your service	Booking, confirming, and performing appointments
Safety	Allergy and patch test records, avoiding adverse reactions
Continuity	So any stylist can pick up your colour or treatment history accurately
Payments	Billing, refunds, memberships, packages, gift vouchers
Service communication	Appointment confirmations, reminders, rescheduling, follow-ups
Marketing	Offers, new services, birthday and anniversary messages — only with your consent
Improving the salon	Understanding which services and time slots work, in aggregate
Advertising	Measuring which campaigns bring in enquiries, and reaching similar audiences
Legal	Tax records, statutory filings, responding to lawful requests

We do not sell your personal information to anyone.

3. Consent, and How to Withdraw It

You give consent when you book with us, fill a form, or opt in to messages. That consent is specific to the purposes listed above.

You can withdraw consent at any time. Tell any member of our front desk team.

Two things worth knowing:

• Withdrawing consent for marketing stops promotional messages. You will still receive appointment confirmations and reminders, because those are part of delivering a service you booked.
• Withdrawing consent for service records means we may not be able to perform certain chemical services safely, since we would no longer hold your patch test and colour history.

Withdrawal applies going forward. It does not undo processing that already happened lawfully.

4. WhatsApp and Messaging

We use WhatsApp Business to send appointment confirmations, reminders, and — separately, and only if you opt in — offers and updates.

• We only message numbers that have opted in
• Every promotional message includes a way to stop
• You can reply STOP at any time to end promotional messages
• We do not add you to broadcast groups or share your number with other clients

Messages are delivered through WhatsApp (Meta) and our messaging provider. Their handling of message data is governed by their own terms.

5. Photographs — Please Read This One

Client photographs are how a salon shows its work, and we ask for them often. Here is exactly how it works:

• We ask before taking any photograph
• We ask again, separately, before publishing an image on Instagram, our website, in print, or in advertising
• Saying no has no effect at all on your service or your relationship with us
• You can withdraw permission for future use at any time by writing to [Email], and we will remove the image from channels we control

One honest limitation: if an image has already been published, we can remove it from our own accounts, but we cannot recall copies that other people have already saved, reposted, or screenshotted. Please factor that in when you say yes.

Images used for internal training or for a stylist’s portfolio are treated the same way — we ask first.

6. Who We Share Information With

We share only what is necessary, and only with:

• Our salon management and booking software provider — appointment, client, and billing records are stored in this system
• Our messaging provider — to deliver WhatsApp and SMS messages
• Meta Platforms — for advertising measurement and audience matching, where you have consented to marketing cookies
• Google — for website analytics
• Our payment gateway — to process transactions
• Our accountants and auditors — for statutory compliance
• Government authorities — where required by law

Each of these processes information on our instructions and under contract.

We may also share information if we merge with, are acquired by, or transfer the business to another entity. You will be told if that happens.

7. Storage and Transfers Outside India

Some of the providers above store data on servers located outside India. Where that happens, we require contractual safeguards for the protection of your information, and we transfer data only to jurisdictions permitted under Indian law.

8. How Long We Keep It

Record	Retention
Client profile and appointment history	While you remain a client, and for 3 years after your last visit
Patch test and allergy records	5 years from the date of the test
Billing and tax records	8 years, as required under tax law
Client photographs	Until you withdraw permission, or 3 years after your last visit
CCTV footage	[30] days, unless retained for a specific incident
WhatsApp message history	2 years
Website analytics	26 months
Academy student records	7 years from course completion

After these periods we delete the information or irreversibly anonymise it.

9. Your Rights

Under the Digital Personal Data Protection Act, 2023, you have the right to:

• Access — ask what personal information we hold about you and how it has been used
• Correction — have inaccurate or incomplete information corrected, and outdated information updated
• Erasure — ask us to delete your information, unless we are required by law to keep it
• Grievance redressal — raise a complaint with us and receive a response
• Nominate — appoint someone to exercise these rights on your behalf if you die or become incapacitated

To exercise any of these, inform the front desk with the mobile number registered with us. We will respond within [30] days.

If you are not satisfied with our response, you may complain to the Data Protection Board of India.

You also have a duty not to submit false information or impersonate another person when making a request.

10. Children

We provide services to children accompanied by a parent or guardian.

Where a client is under 18, we collect and process their information only with the consent of a parent or lawful guardian, verified at the time of booking or at the salon. We do not use children’s information for behavioural advertising or tracking, and we do not process it in any way likely to cause harm.

If you believe we hold information about a child without proper consent, write to us and we will delete it.

11. Security

We protect your information through access controls that limit staff to what their role requires, encrypted storage in our salon management software, secure payment processing that keeps card data out of our systems, staff training on client confidentiality, and physical security for any paper records.

No system is perfectly secure. If a breach affects your personal information, we will inform you in plain language — what happened, what was affected, what we are doing about it, and what you can do — and we will notify the Data Protection Board as required.

12. Cookies

Our website uses:

• Essential cookies — needed for the site and booking to function. These cannot be switched off.
• Analytics cookies — Google Analytics, to understand how the site is used.
• Advertising cookies — the Meta Pixel, to measure advertising and show relevant ads.

You can accept or decline non-essential cookies through the banner on our site, change your choice at any time, and block cookies through your browser settings. Declining non-essential cookies does not affect your ability to book.

13. Contact and Grievances

Contact front desk

We acknowledge complaints within [7] working days and aim to resolve them within [30] days.

14. Changes to This Policy

We update this policy when our practices or the law change. The current version is always on this page, with the date at the top. If a change materially affects how we use your information, we will tell you directly.