Privacy Policy

Last updated: 17 October 2026. What changed: we now describe our newsletter, and the colour pages we offer guests at events (sections 2, 3, 4, 5 and 6). The previous update, on 1 October 2026, moved our online booking to Setmore.

1. Who we are

Colour by Shann is the trading name of Shannon Harford, a sole trader operating from London, England. For the purposes of UK data protection law, Shannon Harford is the controller of the personal information described in this policy.

You can contact us about anything in this policy at [email protected].

This policy explains what information we collect, why we use it, the lawful bases we rely on, who we share it with, how long we keep it, and the rights you have.

2. The information we collect

We collect only the information we need to run the service. Depending on how you interact with us, this may include:

Enquiry information. Your name, email address, the nature of your enquiry and the message you send through our contact form or by email.
Booking information. Your name, contact details, appointment date, service booked, payment status and any correspondence about your booking. Bookings are taken through Setmore, our booking platform, and payments through Square, our payment provider. Both are described in section 4.
Payment information. When you pay for an appointment you enter your card details directly into Square’s secure payment form on our booking page, not into this website. We never see, receive or store your full card number. Square tells us only that a payment has been made, for how much, and the last few digits and card type needed to identify the transaction and issue a refund.
Consultation records. Notes made during or after your appointment, such as the colour characteristics observed, your seasonal result and the guidance provided, so that we can prepare your materials and assist you afterwards.
Information you choose to share for your comfort and safety. If you tell us about accessibility requirements, allergies or sensitivities so that we can adapt your appointment, we record only what is needed to look after you.
Client area information. If we give you access to your own area of this website, we hold your name, your email address, your seasonal result, the guides released to you, and a record of when you signed in and when a guide was downloaded. There is no password: signing in works by a one-time link sent to your email address.
Event colour pages. If we meet at an event and you ask for your colours, we hold your first name, your email address, the home season we found for you, which event it was, and whether you also asked for our newsletter, together with the wording you agreed to.
Newsletter information. If you join our newsletter, your name, your email address and the record of when you confirmed your subscription.
Technical information. Limited, privacy-preserving analytics about visits to our website (described in section 7), and security information processed when you submit our contact form.

We do not knowingly collect information from children. Appointments must be booked by an adult, and anyone under 18 must be accompanied by a parent or guardian.

3. Why we use your information, and our lawful bases

Purpose	Lawful basis
Replying to your enquiry	Legitimate interests (responding to a message you have chosen to send us)
Arranging, delivering and administering your appointment, including preparing your palette and take-home materials	Performance of a contract
Recording accessibility, allergy or sensitivity information you volunteer so that your appointment is safe and comfortable	Your explicit consent, which you may withdraw at any time
Giving you access to your own guides in the client area, and keeping that access secure	Performance of a contract
Sending you the colours, Colour Passport and guide you ask for after meeting us at an event	Legitimate interests (sending you what you have asked us for)
Keeping business and accounting records	Legal obligation
Protecting our website from spam and abuse	Legitimate interests (keeping the service secure)
Sending our newsletter and occasional offers, if you opt in	Consent, which you may withdraw at any time

Booking an appointment, sending an enquiry or asking for your colours at an event never signs you up to marketing. Joining our newsletter is always a separate, active and optional choice, confirmed by a link we email to you, with an unsubscribe link in every message.

4. Who we share information with

We never sell your personal information. We share it only with the service providers who help us operate, each acting under contractual obligations to protect it:

Setmore, a booking service based in the United States, provides our online booking system. When you book, Setmore receives your name, email address, mobile number, the service and time you have chosen, and any comment you add to the booking. Setmore uses this on our behalf to take your booking and to send you booking confirmations, reminders and notice of any change. Setmore’s own privacy notice is at setmore.com/privacy-policy.
Square (part of Block, Inc.) processes card payments for appointments, through a secure payment form within our booking page. Square receives your payment details, the amount and the details needed to take the payment and to handle any refund. For card payments Square acts as a controller in its own right as well as processing on our behalf, because it is regulated in that role. Square’s own privacy notice is at squareup.com/gb/en/legal/general/privacy.
Cloudflare, Inc. hosts our website, provides our privacy-preserving analytics and protects our contact form from abuse (Turnstile). It also stores the event colour records described above, on our behalf. Where you have a client area, Cloudflare also stores your guides and the client area records described above, on our behalf.
Resend, Inc. delivers the email notification generated when you submit our contact form, the sign-in links sent to the client area, and the colours you ask for at an event.
MailerLite sends our newsletter. If you join, MailerLite holds your name, email address and subscription record on our behalf, and sends the email asking you to confirm, and each newsletter. MailerLite’s own privacy notice is at mailerlite.com/legal/privacy-policy.
Our email provider stores the mailbox in which your emails to us are received and answered.
Google LLC holds our photography and testimonial consent records, and any testimonial you choose to send us, in Google Sheets within Google Drive, so that we have a reliable record of exactly what each client has agreed to. Only the details you enter on those forms are stored there.

We may also disclose information where the law requires it, or where necessary to establish, exercise or defend legal claims.

Clicking a booking link on this website takes you to our booking page on Setmore’s website. From that point Setmore’s privacy notice and cookie practices apply in addition to this policy, and Square’s apply to the payment form. Nothing from Setmore or Square is embedded in this website.

5. International transfers

Some of our providers, including Setmore, Square, Cloudflare, Resend and MailerLite, process information on servers outside the United Kingdom, including in the United States and the European Economic Area. Where this happens, the transfer is protected by safeguards recognised under UK data protection law, such as the UK Extension to the EU–US Data Privacy Framework, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with each provider’s own security measures.

6. How long we keep information

Enquiries that do not lead to a booking are kept for up to 12 months, then deleted.
Event colour records are kept for up to 12 months, then deleted. If you joined our newsletter, MailerLite keeps your subscription until you unsubscribe.
Booking records and consultation notes, including the booking details held for us in Setmore, are kept for up to 24 months after your appointment, so that we can answer follow-up questions and honour our commitments to you, unless you ask us to delete them sooner.
Accessibility, allergy or sensitivity information is deleted once it is no longer needed for your appointments, or immediately on request.
Photography and testimonial consent records are kept for as long as we use the material and for one year afterwards, so that we can show what was agreed. If you withdraw your consent, we keep a note of the withdrawal itself, which is the only way to honour it reliably.
Client area records are kept for as long as you have access. Sign-in links expire after 30 minutes and are then deleted; a signed-in session lasts 90 days and is deleted when it expires or when you sign out. Download records are kept for up to 24 months. If you ask us to close your client area, your record, your personal files and your sign-in history are deleted.
Records we must keep by law, such as basic accounting records, are kept for the period required by HM Revenue & Customs, currently at least five years after the relevant tax filing deadline.
Payment records held by Square are kept for as long as Square’s own retention policy and its legal obligations as a regulated payment provider require. We can delete our copy of your details on request, but we cannot delete Square’s transaction records where the law requires Square to keep them.

7. Analytics

We use Cloudflare Web Analytics, a privacy-first measurement tool. It does not use cookies, does not fingerprint your device and does not track you across other websites. It shows us only aggregate information, such as which pages are read and roughly where in the world visitors are, so that we can improve the site.

8. Your rights

Under UK data protection law you have the right to:

Ask for a copy of the personal information we hold about you.
Ask us to correct inaccurate information.
Ask us to delete your information, where no legal obligation requires us to keep it.
Ask us to restrict or object to particular uses of your information.
Receive information you provided to us in a portable format.
Withdraw any consent you have given, at any time, without affecting the service you receive.

To exercise any of these rights, email [email protected]. We will respond within one month.

You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113, although we would welcome the chance to resolve any concern with you first.

9. Security

Our website is served entirely over HTTPS. Card details are handled entirely by Square, in its secure payment form, and never pass through this website. The client area holds no passwords: access is by a single-use link that expires after 30 minutes, and the links and sessions themselves are stored only as one-way hashes, so they cannot be read back out of our records. You can be signed out of every device at once at any time, simply by asking. Access to personal information is limited to Shannon Harford and the service providers listed above, and we collect the minimum information needed for each purpose. No photograph, consultation record or personal detail is ever published without your separate, explicit consent.

10. Changes to this policy

We may update this policy as our services or legal obligations change. The date of the latest version appears at the top of this page, and significant changes will be highlighted on this page.