Privacy Policy

Who we are

Base Kamp, 61 Chorlton St, Manchester, M1 3FY, is the data controller for the personal data described here. You can reach us at hello@basekamp.co.uk.

What we collect

When you create an account

• — Your name, email address and phone number.
• — A hashed version of your password. We never store the password itself.

When you book or pay

• — Your appointments, services, dates and prices.
• — Notes your stylist adds about your appointment or preferences.
• — A payment record and a Stripe reference. We never see or store your full card number — card details go straight to Stripe.

If you're a stylist or partner

• — Your public profile, page content, services and prices.
• — Your chair hires, wallet balance, payouts and Stripe Connect account reference.
• — Subscription and billing records.

When you use the site

• — Page views on stylist, booking and event pages, recorded against a rotating hash of your IP address and browser rather than against you by name.
• — A session cookie so we know you're logged in.

If you sign in at reception

• — Your name and who you're visiting, for building safety and security.

Why we use it, and our lawful basis

• — To run your bookings, memberships and payments — because we need to, to perform our contract with you.
• — To send booking confirmations, reminders and account emails — contract, and our legitimate interest in a service that works.
• — To keep the platform secure and prevent fraud — our legitimate interest.
• — To keep accounting and tax records — our legal obligation.
• — To send marketing — only with your consent, which you can withdraw at any time.

Who we share it with

• — Stripe processes payments, subscriptions and payouts. Stripe is a separate controller for the payment data it holds.
• — Your stylist sees your name, contact details and booking history, so they can carry out your appointment. They act as a controller for their own client records.
• — A partner whose event you've bought a ticket for sees the details needed to admit you.
• — Our email and hosting providers, who process data on our instructions.
• — Authorities, where the law requires it.

We don't sell your personal data.

How long we keep it

• — Account and booking records: for as long as your account is open, then up to 6 years for accounting and legal purposes.
• — Payment records: 6 years, as tax law requires.
• — Visitor sign-ins: 12 months.
• — Page analytics: 24 months.
• — Marketing consent: until you withdraw it.

Your rights

Under UK GDPR you can ask us to:

• — Give you a copy of the personal data we hold about you.
• — Correct anything that's wrong.
• — Delete your data, where we don't have to keep it.
• — Restrict or object to how we use it.
• — Send your data to another provider.
• — Withdraw consent to marketing, at any time.

Email hello@basekamp.co.uk and we'll respond within one month. If you're not happy with how we've handled it, you can complain to the Information Commissioner's Office at ico.org.uk.

Security

Passwords are hashed, card details never touch our servers, and access to the admin tools is restricted to staff who need it. No system is perfectly secure, but we take this seriously and will tell you and the ICO promptly if a breach puts you at risk.

Where your data is held

Our systems are hosted in the UK and the EEA. Where a provider such as Stripe transfers data outside the UK, they do so under safeguards approved for that purpose.

Children

Accounts are for over-18s. Under-18s can be treated at Base Kamp with a parent or guardian present, who books on their behalf.

Changes

If we change this policy we'll update the date at the top, and tell you directly if the change is significant.