Privacy Policy
Last updated: 16 August 2026
1. Who we are
Colour by Shann is the trading name of Shannon Harford, a sole trader operating from London, England. For the purposes of UK data protection law, Shannon Harford is the controller of the personal information described in this policy.
You can contact us about anything in this policy at [email protected].
This policy explains what information we collect, why we use it, the lawful bases we rely on, who we share it with, how long we keep it, and the rights you have.
2. The information we collect
We collect only the information we need to run the service. Depending on how you interact with us, this may include:
- Enquiry information. Your name, email address, the nature of your enquiry and the message you send through our contact form or by email.
- Booking information. Your name, contact details, appointment date, service booked, payment status and any correspondence about your booking. Bookings and payments are taken through Square, our booking and payment platform, which is described in section 4.
- Payment information. When you pay for an appointment you enter your card details directly into Square’s own secure booking pages, not into this website. We never see, receive or store your full card number. Square tells us only that a payment has been made, for how much, and the last few digits and card type needed to identify the transaction and issue a refund.
- Consultation records. Notes made during or after your appointment, such as the colour characteristics observed, your seasonal result and the guidance provided, so that we can prepare your materials and assist you afterwards.
- Information you choose to share for your comfort and safety. If you tell us about accessibility requirements, allergies or sensitivities so that we can adapt your appointment, we record only what is needed to look after you.
- Client area information. If we give you access to your own area of this website, we hold your name, your email address, your seasonal result, the guides released to you, and a record of when you signed in and when a guide was downloaded. There is no password: signing in works by a one-time link sent to your email address.
- Technical information. Limited, privacy-preserving analytics about visits to our website (described in section 7), and security information processed when you submit our contact form.
We do not knowingly collect information from children. Appointments must be booked by an adult, and anyone under 18 must be accompanied by a parent or guardian.
3. Why we use your information, and our lawful bases
| Purpose | Lawful basis |
|---|---|
| Replying to your enquiry | Legitimate interests (responding to a message you have chosen to send us) |
| Arranging, delivering and administering your appointment, including preparing your palette and take-home materials | Performance of a contract |
| Recording accessibility, allergy or sensitivity information you volunteer so that your appointment is safe and comfortable | Your explicit consent, which you may withdraw at any time |
| Giving you access to your own guides in the client area, and keeping that access secure | Performance of a contract |
| Keeping business and accounting records | Legal obligation |
| Protecting our website from spam and abuse | Legitimate interests (keeping the service secure) |
| Sending marketing, if you ever opt in | Consent, which you may withdraw at any time |
Booking an appointment or sending an enquiry never signs you up to marketing. If we introduce a newsletter, joining it will always be a separate, active and optional choice, with an unsubscribe link in every message.
4. Who we share information with
We never sell your personal information. We share it only with the service providers who help us operate, each acting under contractual obligations to protect it:
- Square (part of Block, Inc.) provides our online booking system and processes card payments for appointments. When you book, Square receives your name, email address, telephone number if you give one, the service and time you have chosen, any note you add to the booking, and your payment details. Square uses this to take your booking, take payment, send you booking confirmations and reminders, and handle refunds. For card payments Square acts as a controller in its own right as well as processing on our behalf, because it is regulated in that role. Square’s own privacy notice is at squareup.com/gb/en/legal/general/privacy.
- Cloudflare, Inc. hosts our website, provides our privacy-preserving analytics and protects our contact form from abuse (Turnstile). Where you have a client area, Cloudflare also stores your guides and the client area records described above, on our behalf.
- Resend, Inc. delivers the email notification generated when you submit our contact form, and the sign-in links sent to the client area.
- Our email provider stores the mailbox in which your emails to us are received and answered.
- Google LLC holds our photography and testimonial consent records, and any testimonial you choose to send us, in Google Sheets within Google Drive, so that we have a reliable record of exactly what each client has agreed to. Only the details you enter on those forms are stored there.
We may also disclose information where the law requires it, or where necessary to establish, exercise or defend legal claims.
Clicking a booking link on this website takes you to Square’s own booking pages, on Square’s website. From that point Square’s privacy notice and cookie practices apply in addition to this policy. Nothing from Square is embedded in this website.
5. International transfers
Some of our providers, including Square, Cloudflare and Resend, process information on servers outside the United Kingdom, including in the United States and the European Economic Area. Where this happens, the transfer is protected by safeguards recognised under UK data protection law, such as the UK Extension to the EU–US Data Privacy Framework or the UK International Data Transfer Agreement, together with each provider’s own security measures.
6. How long we keep information
- Enquiries that do not lead to a booking are kept for up to 12 months, then deleted.
- Booking records and consultation notes are kept for up to 24 months after your appointment, so that we can answer follow-up questions and honour our commitments to you, unless you ask us to delete them sooner.
- Accessibility, allergy or sensitivity information is deleted once it is no longer needed for your appointments, or immediately on request.
- Photography and testimonial consent records are kept for as long as we use the material and for one year afterwards, so that we can show what was agreed. If you withdraw your consent, we keep a note of the withdrawal itself, which is the only way to honour it reliably.
- Client area records are kept for as long as you have access. Sign-in links expire after 30 minutes and are then deleted; a signed-in session lasts 90 days and is deleted when it expires or when you sign out. Download records are kept for up to 24 months. If you ask us to close your client area, your record, your personal files and your sign-in history are deleted.
- Records we must keep by law, such as basic accounting records, are kept for the period required by HM Revenue & Customs, currently at least five years after the relevant tax filing deadline.
- Booking and payment records held by Square are kept for as long as Square’s own retention policy and its legal obligations as a regulated payment provider require. We can delete our copy of your details on request, but we cannot delete Square’s transaction records where the law requires Square to keep them.
7. Analytics
We use Cloudflare Web Analytics, a privacy-first measurement tool. It does not use cookies, does not fingerprint your device and does not track you across other websites. It shows us only aggregate information, such as which pages are read and roughly where in the world visitors are, so that we can improve the site.
8. Your rights
Under UK data protection law you have the right to:
- Ask for a copy of the personal information we hold about you.
- Ask us to correct inaccurate information.
- Ask us to delete your information, where no legal obligation requires us to keep it.
- Ask us to restrict or object to particular uses of your information.
- Receive information you provided to us in a portable format.
- Withdraw any consent you have given, at any time, without affecting the service you receive.
To exercise any of these rights, email [email protected]. We will respond within one month.
You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113, although we would welcome the chance to resolve any concern with you first.
9. Security
Our website is served entirely over HTTPS. Card details are handled entirely by Square on Square’s own pages and never pass through this website. The client area holds no passwords: access is by a single-use link that expires after 30 minutes, and the links and sessions themselves are stored only as one-way hashes, so they cannot be read back out of our records. You can be signed out of every device at once at any time, simply by asking. Access to personal information is limited to Shannon Harford and the service providers listed above, and we collect the minimum information needed for each purpose. No photograph, consultation record or personal detail is ever published without your separate, explicit consent.
10. Changes to this policy
We may update this policy as our services or legal obligations change. The date of the latest version appears at the top of this page, and significant changes will be highlighted on this page.