Last updated: 5 August 2026

This policy explains what personal information Matted Hair London collects about you, why it is collected, how long it is kept and what control you have over it. It is written to be read by clients and by the people who support them, not only by lawyers. If anything here is unclear, please ask and I will explain it in plain terms.

Who is responsible for your information

Matted Hair London is a sole trader business run by Vitalii Prisacari. I am the data controller for the information described in this policy, which means I decide what is collected and what happens to it.

Matted Hair London

Burgess Court, Adenmore Road, London SE6 4BT

Telephone: +44 7902 020201

Email: hello@matted.co.uk

Website: https://matted.co.uk

There is one practitioner in this business. I see your information myself. It is not passed to a team, and there is no call centre.

What this policy covers

It covers the website at https://matted.co.uk, the enquiry form on that website, messages you send me by email, telephone, text message or WhatsApp, and the records I keep about work I carry out for you.

What personal information I collect

When you use the enquiry form or contact me directly

• Your name.
• Your telephone number.
• Your email address.
• The area of London you are in, and a full address if you are booking a home visit.
• What you tell me in your message.
• Photographs of hair and scalp, if you choose to attach them.

Any health or personal context you choose to share

Many people tell me why their hair has reached the state it is in. That may involve depression, autism, a long illness, a hospital stay, a bereavement, a period of crisis, or care needs. You are never obliged to tell me any of this. I ask only what I need in order to judge whether I can help, how long a session is likely to take and whether any adjustment is needed. If you would rather not explain, say so and I will not press.

When you book

• The date and time of the session and the address where it will take place.
• Payment information relating to the £100 booking deposit and the balance. Card details are handled by Stripe and are never seen or stored by me.

During and after a session

• Working notes about what was done, how long it took and anything relevant to a future session.
• Photographs taken before, during and after the work, where you agree to them being taken.

When you visit the website

• Standard technical information such as your device type, browser, approximate location derived from your IP address, the pages you view and how you arrived at the site. This is collected by a third-party analytics service. See the sections on cookies and analytics below.

Photographs, health information and special category data

This part matters, so it is set out at length.

A photograph of a person’s hair and scalp is ordinary personal data on its own. However, when a photograph is held alongside information about a person’s health, a diagnosis, a mental health condition or a period of illness, the combination can reveal something about that person’s health. Under UK GDPR, information about health is special category data and is given extra protection. I treat photographs of your hair and scalp, together with anything you tell me about your health, as special category data. That is the cautious position and it is the one I work to.

Special category data needs a lawful basis under Article 6 and a separate condition under Article 9. For this business:

• To carry out the work you have asked for, I rely on Article 6(1)(b), performance of a contract, and Article 9(2)(a), your explicit consent. Explicit consent means you have been told clearly what will be held and why, and have agreed to it specifically. Booking a session is not by itself explicit consent to hold health information. I ask separately.
• To show a photograph in the public gallery on the website or on social media, I rely on Article 6(1)(a) and Article 9(2)(a), your explicit consent, given separately again. This is dealt with in its own section below.
• To defend or bring a legal claim, or to deal with an insurance matter, I rely on Article 9(2)(f).
• In a genuine emergency where someone’s life is at risk and they cannot consent, I rely on Article 9(2)(c), vital interests.
• Where I have to raise a safeguarding concern about a child or an adult at risk, I rely on Article 6(1)(f), legitimate interests, together with the safeguarding condition in the Data Protection Act 2018, Schedule 1, Part 2, paragraph 18. In that narrow situation I may share information without your consent. My safeguarding policy explains when and why.

Lawful bases in summary

• Article 6(1)(a), consent. Gallery photographs, marketing messages, non-essential cookies including analytics.
• Article 6(1)(b), contract. Arranging, delivering and being paid for a session.
• Article 6(1)(c), legal obligation. Tax and accounting records.
• Article 6(1)(f), legitimate interests. Replying to an enquiry that does not lead to a booking, keeping a record of work carried out, protecting the business against a claim, and safeguarding referrals. My interest here is running a service safely and being able to account for what I did. I have weighed this against your interests and believe it is proportionate. You may object at any time, as set out below.
• Article 9(2)(a), (c) and (f), and Data Protection Act 2018 Schedule 1 Part 2 paragraph 18. As described in the section above.

How photographs are used

Photographs serve three separate purposes and each is treated differently.

Assessment. A photograph sent with an enquiry lets me judge the degree of matting, quote the right price band and set aside the right amount of time. Without one I am guessing. Assessment photographs are used by me alone and are not published.

Record of the work. Before and after photographs taken during a session form part of my working record. They matter if a question is later raised about the condition of hair or scalp, and my insurer may ask for them. They are not published unless you separately agree.

The public gallery. Photographs appear on the website only where you have given separate, specific, written opt-in consent for that photograph to be published. This consent is not part of booking, it is not buried in terms and conditions, and refusing it changes nothing about the service you receive or the price you pay. You may ask for a face to be excluded, for a photograph to be cropped, or for no identifying detail to appear.

Withdrawing gallery consent. You may withdraw consent at any time, for any reason or none, by emailing hello@matted.co.uk or telephoning +44 7902 020201. I will remove the photograph from the website within 5 working days and from any social media account I control within 10 working days. Withdrawal does not undo publication that has already happened, and I cannot recall a copy that a third party has already saved, but nothing further will be published. Withdrawing consent for the gallery does not oblige me to delete the working record copy, which is kept for the retention period set out below.

How long information is kept

Concrete periods, not vague ones.

• Enquiries that do not lead to a booking. Message, contact details and any attached photographs are deleted 12 months after the last contact between us. If you ask me to delete sooner, I will.
• Client records for work carried out. Name, contact details, session notes and consent records are kept for 6 years from the end of our working relationship. This matches the ordinary limitation period for contract and negligence claims in England and Wales, and it is the period my public liability insurer expects.
• Assessment photographs where a booking followed. Merged into the client record and kept for the same 6 years.
• Gallery photographs. Kept while your consent stands. Removed from the website within 5 working days of you withdrawing consent.
• Health information you volunteered. Kept only as long as it remains relevant to your care, and reviewed at the end of the working relationship. Anything no longer needed is deleted at that point. Anything still needed is held within the client record for the same 6 years.
• Safeguarding records. Kept for 7 years from the date of the record. Where the record concerns a person who was under 18 at the time, it is kept until their 25th birthday.
• Financial and tax records, including deposit and payment records. Kept for at least 5 years after the 31 January submission deadline for the relevant tax year, as HM Revenue and Customs requires.
• WhatsApp, text and email threads. Deleted 12 months after the last contact, unless the content forms part of a client record or a safeguarding record.
• Website analytics data. Retained in the analytics provider’s system for no more than 14 months and held in aggregate form rather than as a named individual record.

When a retention period ends, digital files are deleted and any paper is shredded.

Who else sees your information

I keep the list of third parties as short as I can. At present it is:

• Website hosting and email. [hosting provider name] hosts the website and the hello@matted.co.uk mailbox, and therefore stores enquiry emails and any attachments on its servers.
• Website analytics. [analytics provider name] collects the technical and usage information described above. It is used to understand which pages people read and where visitors come from. It is not used to identify you by name.
• Stripe. Stripe processes card payments for the £100 deposit and for balances paid by card. Your card details go directly to Stripe and are never held by me. Stripe is its own data controller for payment data and publishes its own privacy policy at https://stripe.com/gb/privacy.
• WhatsApp, owned by Meta. If you choose to contact me on WhatsApp, Meta processes that message under its own terms. Message content is end to end encrypted, but Meta will still know that you and I exchanged messages. If you would rather not use WhatsApp, email or telephone works just as well.
• Google. Matted Hair London holds a Google Business Profile and displays a review rating of 4.9 out of 5 from 13 Google reviews. If you choose to leave a review, that is a transaction between you and Google under Google’s terms, and whatever you write is public. I cannot delete a review you post, and I never offer anything in exchange for one.
• Accountant and, if it ever became necessary, insurer or legal adviser. Only the minimum needed, and only where there is a genuine reason.

I do not sell your information. I do not share it with advertisers. I do not use it to build a profile of you and I do not make automated decisions about you.

Some of these providers are based outside the United Kingdom, mainly in the United States or the European Union. Where information is transferred outside the UK, it is protected either by UK adequacy regulations, by the UK extension to the EU-US Data Privacy Framework, or by an International Data Transfer Agreement or the UK Addendum to the European Commission’s standard contractual clauses.

Cookies and analytics

The website sets a small number of cookies. Strictly necessary cookies keep the site working, remember your cookie choice and protect the enquiry form from abuse. These do not need your consent.

Analytics cookies and similar technologies are not strictly necessary. Under the Privacy and Electronic Communications Regulations 2003 they require your consent, so they are set only after you agree through the cookie banner. If you decline, or ignore the banner, no analytics cookie is set. You can change your mind at any time by clearing the site’s cookies in your browser and choosing again, and you can block cookies entirely in your browser settings. Blocking analytics cookies does not stop you using the site or contacting me.

Your rights

Under UK GDPR you have the following rights. All of them are free to use, and none of them requires a reason.

• The right to be informed. To know what is collected and why, which is what this document is for.
• The right of access. To ask for a copy of the personal data I hold about you. I will respond within one month.
• The right to rectification. To have inaccurate information corrected and incomplete information completed.
• The right to erasure. To ask for your information to be deleted. I will do so unless I am required to keep it, for example a tax record or a safeguarding record, and if that applies I will tell you which record and why.
• The right to restrict processing. To ask me to hold information but stop using it, for example while a dispute about accuracy is resolved.
• The right to data portability. To receive the information you gave me in a common electronic format.
• The right to object. To object to processing based on legitimate interests, and to object at any time to direct marketing, which I will stop immediately.
• Rights relating to automated decision-making and profiling. I do not use either, so no decision about you is made by a machine.
• The right to withdraw consent. Set out in the next section.

To exercise any of these, email hello@matted.co.uk or telephone +44 7902 020201. I may ask you to confirm your identity, so that I do not hand your information to someone else. I will respond within one month and will tell you if a complex request needs longer.

How to withdraw consent

Where I rely on your consent, you can withdraw it at any time. That includes consent for a photograph in the gallery, consent for me to hold health information you volunteered, consent to receive messages from me, and consent to analytics cookies.

Email hello@matted.co.uk or telephone +44 7902 020201 and say what you are withdrawing. You do not need to give a reason and you do not need to use any particular form of words. Withdrawing consent is as easy as giving it. It does not affect the lawfulness of anything done before you withdrew, and it does not affect your right to be treated properly if you book again.

Keeping information secure

Devices are encrypted and protected by a passcode. Accounts holding client information use strong, unique passwords and two-factor authentication where the provider supports it. Photographs are stored in a folder that is not shared and not synchronised to any public service. Paper notes, where they exist, are kept locked away and shredded once the retention period ends. Only I have access.

If a breach occurs that is likely to risk your rights and freedoms, I will report it to the Information Commissioner’s Office within 72 hours of becoming aware of it and will tell you directly where the risk to you is high.

Children

This service is aimed at adults. Where work involves a person under 18, I deal with a parent, guardian or the professional responsible for their care, and consent for photographs is given by that adult as well as, wherever the young person is able to express a view, by the young person themselves. I do not knowingly collect information about a child through the website.

Complaints

If you are unhappy with how your information has been handled, please tell me first at hello@matted.co.uk or +44 7902 020201. I would rather put something right than have you left with a bad experience.

You also have the right to complain directly to the UK’s data protection regulator, and you can do that whether or not you have raised it with me.

Information Commissioner’s Office

Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Helpline: 0303 123 1113

Website: https://ico.org.uk

Complaints: https://ico.org.uk/make-a-complaint/

Changes to this policy

If this policy changes, the new version will be published at https://matted.co.uk/privacy-policy/ and the last updated date at the top will change. Where a change materially affects how your information is used, I will tell clients directly.

—

Notes for completion before publishing

Remove this block once the details are filled in.

1. Replace [hosting provider name] with the actual website and email host.
2. Replace [analytics provider name] with the actual analytics service in use on the site.
3. Confirm that the live cookie banner genuinely blocks analytics until consent is given. If it does not, either fix the banner or amend the cookies section so that it describes what actually happens.