Privacy Policy

This policy explains how CuraDesk uses personal data when you visit curadesk.co.uk, contact us or book a demo. We process personal data in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

1. Who we are

CuraDesk is the data controller for the personal data described in this policy. You can contact us about anything in this policy at hello@curadesk.co.uk.

This policy covers our website and sales enquiries. When a spa uses CuraDesk to manage its own clients' bookings, the spa is the controller of that client data and CuraDesk acts as its processor under a data processing agreement.

2. What we collect and why

• Enquiries and emails. Your name, email address, spa name and anything you choose to tell us, used to reply to you. Lawful basis: legitimate interests (responding to business enquiries), or steps taken at your request before entering into a contract.
• Demo bookings. Your name, email address, chosen time and any notes, used to arrange and hold the demo. Lawful basis: steps taken at your request before entering into a contract.
• Website analytics. Only if you accept analytics cookies: pages viewed, clicks on demo buttons, approximate location (country/city), device and browser type, and referring site. Lawful basis: consent.
• Technical data. Our hosting provider records IP addresses and request details in server logs to keep the site secure and working. Lawful basis: legitimate interests (security and reliability).

We do not sell personal data and we do not use it for automated decision-making that has legal or similarly significant effects on you.

3. Cookies and similar technologies

When you first visit, we ask whether you accept analytics cookies. Nothing non-essential is set until you choose, and you can change your mind at any time using Cookie preferences (also in the footer of every page).

Our pages load fonts from Google Fonts, which means your browser sends your IP address to Google when the page loads. Google states that it does not use this to build profiles or set cookies.

4. Analytics

We use Google Analytics 4, provided by Google Ireland Limited, to understand how visitors use our site and which pages lead to demo bookings. It only runs after you accept analytics cookies. IP addresses are not stored by Google Analytics 4. You can withdraw consent at any time through Cookie preferences, after which no further analytics data is collected and the analytics cookies are removed.

5. Who we share data with

We use a small number of service providers who process data on our behalf under written contracts:

• Hostinger: website hosting and email.
• Google: analytics (with your consent) and web fonts.
• Calendly: demo scheduling, when you book a demo.

Some of these providers may process data outside the UK, including in the United States. Where they do, transfers are protected by UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework) or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses. We may also disclose data where required by law.

6. How long we keep data

• Enquiry emails and demo bookings: up to 24 months after our last contact, unless you become a customer.
• Analytics data: 14 months, after which Google deletes it automatically.
• Your cookie choice: 12 months, after which we ask again.
• Server logs: kept by our hosting provider for a limited period for security purposes.

7. Your rights

Under UK GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased;
• restrict or object to how we use your data;
• receive your data in a portable format;
• withdraw consent at any time, where we rely on consent.

To use any of these rights, email hello@curadesk.co.uk. We will respond within one month. It is free of charge.

If you are unhappy with how we handle your data, please tell us first so we can put it right. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

8. Security

Our website is served only over encrypted HTTPS connections, and access to the data we hold is limited to the people who need it.

9. Changes to this policy

We will update this page if the way we use personal data changes. The date at the top shows when it was last revised.