Privacy notice

Who we are

Westly is a trading name of Digital Kingston Limited, a company registered in England and Wales (company number 14023080), of Unit C2, Boulevard Industrial Estate, Hull, HU3 4BA. We are registered with the Information Commissioner’s Office (ICO) under reference ZB586560.

Westly is online booking and salon software. Salons use it to run their diary, client records and till, and people use it to find salons and book appointments.

For anything about this notice or your information, write to support@westly.uk or to the address above.

Our role: when we decide, and when the salon does

Westly is the controller (we decide how the information is used) for:

• the accounts of salon owners and their team;
• customer accounts, the Westly account you can create and use at westly.uk/my;
• the Westly directory and salon pages, and the record of which customers found a salon through Westly;
• billing salons, support requests, and keeping Westly secure.

Each salon is the controller of its own client records: the appointments, notes, consent choices and payments it keeps about its clients. For those, Westly is the salon’s processor. We hold and handle them only on the salon’s instructions, under a data processing agreement, and we do not use them for anything else. We never sell them, give them to another salon, or use them to market other salons to you. If you want to see, correct or delete what a salon holds about you, ask the salon. If you ask us, we will pass your request on.

What we hold, why, and our lawful basis

Salon owners and team

Name, email, phone, role, working hours and the services each person offers, the business’s name, address and billing details, and a record of actions taken in the account. We use these to provide the service the salon signed up for, and to bill it (lawful basis: contract). We keep VAT invoices and accounting records because tax law requires it (legal obligation).

Booking an appointment

When you book, we collect your name, email, and mobile if you give one, the service, time and stylist, and anything you write in the booking. We pass these to the salon and send you the confirmation, so we can make the booking you asked for (contract, or steps you asked us to take before one). Once made, the booking is part of the salon’s records, and the salon is the controller of it.

Your Westly customer account

Your name, email, mobile (and whether you have verified it by a text code), your password if you set one, your bookings, salons you save, your marketing choices at each salon, and anything you add for your appointments: notes, allergies or sensitivities, your birthday (day and month only) and up to three photos of a visit. We use these to run your account (contract). When you edit your details, the change is copied to your record at each salon you are connected to, so they stay correct. Your notes, allergies and birthday are shared with the salons you book with and nobody else. Your visit photos are private to you; the salon does not see them.

An allergy or skin note can be health information. Only add what you want the salon to know for your safety. We use it only to show it to the salons you book with, and you can change or delete it at any time.

Security, and keeping Westly working

When you sign in we record the session, with the IP address and the browser it came from, and sign-in links record the IP address that asked for and used them. Our web server logs record IP addresses and browsers for each request. We limit sign-in attempts using a scrambled (hashed) form of the email, not the email itself. We use this to keep accounts and the service secure and to stop abuse (legitimate interests: protecting our users and Westly). Customer names and contact details are not written into Westly’s system event logs.

Support

If you use the contact form or email support@westly.uk, we keep your name, email, the salon it is about and the messages, so we can answer you and keep a record of what was said (legitimate interests, or contract for a salon’s account).

The directory and salon pages

Salons that join Westly choose what their public page shows. Westly also lists some businesses that have not joined (see the independent directory below). Our lawful basis for the directory is legitimate interests: running a useful, factual local directory. We count taps on Call, Website and Directions as monthly totals, and count how people arrive at salon pages, without recording who they are.

Marketing

A salon can send you offers and news by email, such as campaigns, a birthday offer or a reminder to rebook, only if you have said yes to marketing from that salon (consent). Every one has a link to stop them, and you can turn them off for each salon in your account. The salon decides what it sends. Westly does not send its own marketing to customers, and there are no marketing texts.

Emails and texts about your bookings

Service messages are about a booking you made: the confirmation, changes of time, cancellations, reminders, and a request to review a visit (at most one a month for each salon). They are not marketing, so we send them without asking for consent (legitimate interests, and to perform the booking). Turning off marketing does not stop them.

Texts. Some salons have booking texts switched on. At those salons we text a UK mobile you gave with the booking or on your record: a confirmation, a cancellation, a new time, and a reminder at the time you chose (2, 24 or 48 hours before, or none). You will not be texted if you have said no to text reminders at that salon or turned reminders off. Texts come from the name “Westly”, cannot be replied to, and give the salon’s name and phone number. Westly sends no marketing by text.

Who receives your information

The salons you book with receive your booking and your details. We also use these service providers (sub-processors), each under a written contract:

• Katapult: hosts the server, database and files Westly runs on, in the UK.
• Postmark: sends Westly’s emails.
• Twilio: sends texts, reports whether they arrived, and sends mobile verification codes.
• Stripe: takes card deposits, only for salons that use them. The payment goes to the salon’s own Stripe account, and your card details go to Stripe, never to Westly. Stripe is also a controller of payment data in its own right.
• Bunny: stores and serves images (salon photos and visit photos), in London, and holds the encrypted off-site copies of our backups, in Germany. They are encrypted before they leave our server, and Bunny does not hold the key.

For our own accounts we use Xero, which holds a salon’s billing name and address and its invoices from Westly. It holds no client records. Emails to support@westly.uk are held by our email host. We may also share information where the law requires it, or with professional advisers.

Information sent outside the UK

Westly’s server and database are in the UK. Some of our providers are based in, or may reach data from, the United States or the European Union. The EU has UK adequacy regulations. For the United States, we rely on the UK Extension to the EU–US Data Privacy Framework (the “UK–US data bridge”) where a provider is certified to it, and otherwise on the ICO’s International Data Transfer Agreement (IDTA) or the UK Addendum to the EU standard contractual clauses. We are confirming the mechanism for each provider. Ask us at support@westly.uk for details.

How long we keep it

• Your customer account is kept until you delete it. You can delete it yourself under My details. That deletes your sign-in and password, your notes, allergies and birthday, saved salons and visit photos, removes your name, email and mobile from your Westly account, and stops marketing at every salon. Each salon keeps its own record of your past appointments, as any business would.
• A salon’s client records are kept for as long as the salon uses Westly. A salon can archive a client, which hides the record but keeps it. When a salon closes its account, nothing is deleted automatically: within 90 days after it closes, we delete or anonymise its client records, except what the law requires us to keep.
• Invoices and accounting records are kept for as long as tax law requires.
• Sign-in sessions, with their IP address and browser, are deleted 90 days after they expire or you sign out. Sign-in and reset links are deleted 30 days after they are used, or 90 days after they expire unused, and mobile verification codes 90 days after they expire.
• Support requests are kept at present, and we have not yet set a fixed period for removing them.
• Web server logs are kept for a short time and then rotated away. Counts of how people arrive at salon pages are kept for 180 days.
• Backups are taken every night. Copies on our server are kept for 14 days. The encrypted off-site copies are kept as follows: every night’s copy for 35 days, then one copy a week until it is about six months old, after which it is deleted. Backups are used only to restore Westly.

Cookies and storage in your browser

Westly uses only what it needs to work. There are no advertising or analytics cookies, no third-party tracking, and no third-party scripts. Maps are drawn from Westly’s own map files.

• Sign-in cookies (westly_at and westly_rt) keep you signed in. Your browser’s scripts cannot read them. The first lasts a short time and is renewed while you use Westly, the second lasts up to 30 days, and both are removed when you sign out.
• A booking in progress: if you sign in part-way through booking, the service and time you chose (never your details) are kept in your browser for 30 minutes, so you do not have to start again.
• Your preferences: light or dark theme, salons you recently viewed, and whether you closed a tip. These stay in your browser and are never sent to us.

Because these are strictly necessary, or only remember a choice you made, we do not ask for consent to them. You can clear them in your browser at any time.

Your rights

You have the right to:

• ask for a copy of your information (in your account, choose Download my data);
• have it corrected;
• have it deleted;
• restrict how it is used;
• object to use based on legitimate interests;
• withdraw consent to marketing at any time;
• receive information you gave us in a format you can take elsewhere.

Some rights depend on the lawful basis and have exceptions. For a salon’s records about you, ask the salon first. For anything else, write to support@westly.uk. We will answer within one month.

If you are unhappy with how we have handled your information, you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113. We would like the chance to put it right first.

Businesses listed in the independent Westly directory

Some appointment businesses appear in Westly’s directory even though they have not joined Westly. We identify these pages clearly as independent directory listings. Where information on one of these pages is personal data, Westly is the controller.

Information we use. For an independent directory listing we may use: the business or trading name; business category; customer-facing business address and postcode; telephone number published for customers; normal opening hours; the business’s website address; basic location information; and the source of the information and the date we checked it. We do not use an independent directory listing to publish owners’ or staff names, email addresses, customer information, reviews, photographs or private information.

Where the information comes from. For the current pilot, information is manually checked against the business’s own public website. We do not copy independent-listing data from third-party directories or social networks. Map positions are the centre of the business’s postcode, from the ONS Postcode Directory (Open Government Licence).

Why we use it. We use this information to provide people with a factual local directory that helps them find and contact appointment businesses. Where the information is personal data, our lawful basis is legitimate interests under Article 6(1)(f) UK GDPR. Our legitimate interest is operating a useful factual local-business directory. You can ask us at support@westly.uk for a copy of our legitimate interests assessment.

Businesses have not joined Westly. An independent directory listing does not mean the business is a Westly member, customer, partner or endorser. Westly does not take bookings for a business through an independent listing.

Telling the business first. Before a listing is published we post a notice to the business at its address, saying what we intend to show, where it came from and how to object or correct it, and we wait at least seven days. That waiting period is Westly’s own policy, not a legal requirement.

Who receives the information. The directory information is visible to visitors to the relevant public page. It is also processed by the service providers that host and back up Westly: Katapult, which hosts the server Westly runs on, and Bunny, which stores Westly’s encrypted backups.

How long we keep it. We keep an independent listing while it remains appropriate and reasonably accurate. We re-check every listing at least every six months and remove businesses that have closed or should no longer be listed. Correction and removal case records may be kept for up to two years where reasonably necessary to show how a request was handled. Where a business asks not to be listed, we keep a minimal suppression record — the business name, postcode and website address — for as long as reasonably necessary to prevent accidental re-listing, and review it every three years. Counts of taps on Call, Website and Directions are monthly totals with nothing about who tapped.

Your rights. Where the information is personal data, applicable rights may include access, rectification, erasure, restriction and objection. You have the right to object to processing based on legitimate interests on grounds relating to your particular situation. Westly’s policy is to remove an independent listing following an objection rather than seek to keep it online over the business’s objection.

To object, correct or remove a listing, use westly.uk/directory/remove or westly.uk/directory/correct, or write to support@westly.uk. You do not need a Westly account. You may also complain to the Information Commissioner’s Office at ico.org.uk.

Changes to this notice

We update this notice when what Westly does changes, and change the date at the top.