Privacy policy
Last updated: 14 October 2026
This policy explains how your personal data is handled when you visit this website, contact us, have a consultation or receive electrolysis treatment.
1. Who we are
Electrolysis by Natalia is an electrolysis hair removal business based in London, run by the sole trader who owns and runs Electrolysis by Natalia (“we”, “us”, “Natalia”). We are the controller of your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
You can contact us via Instagram Direct (@electrobynatalia).
2. Personal data we collect
When you visit this website. The website has no contact forms, no analytics, no advertising tools and does not set cookies. To deliver the site, our hosting provider automatically processes technical data such as your IP address, browser type and the pages requested. Fonts are loaded from Google Fonts, which receives your IP address. If you switch language, your choice is stored only on your own device (see our Cookie policy).
When you contact us. If you message us on Instagram, we receive your username, the profile information you make visible, your messages and anything you choose to send (for example photos).
When you have a consultation or treatment. To assess whether treatment is safe and suitable for you, and to keep proper records, we may collect:
- your name, contact details and date of birth;
- health information, such as medical conditions, medication, allergies, skin conditions, pregnancy and implanted devices (for example a pacemaker);
- details of the area to be treated, previous hair removal and your treatment goals;
- treatment records, such as dates, areas treated, how your skin responded and the aftercare advice given;
- your signed consultation and consent forms;
- payment records (amount, date and method). We do not store full card details.
Health information is “special category data” and is given extra protection by law.
3. How we use your data and our lawful bases
- Replying to enquiries and arranging appointments — to take steps at your request before entering into a contract, and our legitimate interest in responding to you.
- Assessing suitability and providing treatment safely — performance of our contract with you. Health data is processed with your explicit consent, which you give on the consultation form.
- Keeping treatment records — our legal obligations (including any local authority licensing conditions) and our legitimate interest in providing safe, continuous care. Where needed, health records are also kept to establish, exercise or defend legal claims.
- Accounting and tax — our legal obligations (for example to HM Revenue & Customs).
- Running and securing this website — our legitimate interest in operating a working, secure website.
- Marketing — we only send promotional messages if you have agreed to receive them, and you can opt out at any time.
We do not sell your data, and we do not make decisions about you by automated means.
4. Withdrawing consent
Where we rely on your consent, you can withdraw it at any time by contacting us. This does not affect processing that has already taken place. If you withdraw consent to the use of your health information, we may not be able to treat you safely. Records we are legally required to keep will be kept for the period described below.
5. Who we share data with
We only share personal data where necessary:
- our website hosting provider, and Google (Google Fonts), to deliver this website;
- Meta Platforms (Instagram), which processes the messages you send us under its own privacy policy;
- our accountant and HM Revenue & Customs, for tax and accounting purposes;
- our insurer and professional or legal advisers, if needed to deal with a claim or complaint;
- a local authority or other regulator, where required by law or licensing conditions;
- emergency services or a medical professional, if necessary to protect your vital interests.
We do not share your data with anyone else unless the law requires it.
6. International transfers
Some service providers (such as Meta, Google and website hosting providers) may process data outside the UK, including in the United States. Where this happens, they rely on safeguards recognised under UK law, such as the UK International Data Transfer Agreement or Addendum, or the UK–US data bridge.
7. How long we keep data
- Enquiries that do not lead to an appointment: we aim to delete our copies within 12 months of the last contact. Messages also remain on Instagram under Meta's own policies.
- Client and treatment records: 7 years after your last treatment (or, for anyone treated under 18, until they turn 25), so that we can meet insurance requirements and respond to any legal claims.
- Financial records: as long as tax law requires, normally 6 years.
- Website server logs: as set by our hosting provider, normally a short period.
8. Keeping your data secure
Paper records are stored securely and digital records are protected by passwords and device security. Access is limited to Natalia and, where necessary, the advisers listed above. No method of storage or transmission is completely secure, but we take reasonable steps to protect your data.
9. Your rights
Under UK data protection law you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have data deleted, where there is no lawful reason for us to keep it;
- restrict or object to certain processing;
- receive your data in a portable format, where applicable;
- withdraw consent at any time, where we rely on consent.
To use any of these rights, contact us via Instagram Direct (@electrobynatalia). We will respond within one month. There is normally no charge.
10. Complaints
If you are unhappy with how we handle your data, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk, telephone 0303 123 1113.
11. Children
This website and our services are intended for adults. We do not knowingly collect data from children through this website. Anyone under 18 may only be treated with the consent of a parent or guardian, and at Natalia's discretion.
12. Changes to this policy
We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated.