Studio 95 Privacy Policy

STUDIO 95 — BOOKING PRIVACY NOTICE Version: studio95-privacy-2026-10-21-v3. 21 October 2026. Who is responsible for your booking information Studio 95 decides how your information is used to provide and manage its appointments and packages. This notice covers bookings made through Pepperseed. It does not describe separate health questionnaires, marketing lists or other services that are not part of this booking journey. Contact Oliver Rogers at Studio 95: oliver@studio95.uk; 07780 607615; 95 Salisbury Rd, Worcester Park KT4 7BZ, UK. Website: https://studio95.uk/. Information used for your booking We use your name, email address and telephone number; selected service or treatment preference; appointment date, time and booking status; price and payment arrangement; and cancellation, refund and service communications. For packages, we also use your purchased package version, payment status and provider references, original expiry, entitlement status, credit balance and credit-use history. Where required, we record which versions of the booking terms and privacy information you accepted or acknowledged and when. The booking system also uses access credentials, verification status, timestamps and limited technical/security information to secure requests, protect package access and prevent duplicate or abusive activity. Credentials are protected using server-side hashes where supported by the access system. Please do not enter card details, passwords or unnecessary medical information in booking fields or emails. This booking notice does not authorise the collection of health information through free-text messages. Why your information is used Contract: to take steps at your request before booking, arrange and fulfil your appointment or package, process payment and eligible refunds or credit returns, send service confirmations and manage changes or cancellations. Legal obligations: to keep records needed for applicable accounting, tax or other legal requirements and respond to lawful requests. Legitimate interests: to protect customers and purchased credits, prevent fraud and misuse, maintain reliable booking records, resolve disputes and establish or defend legal claims. These purposes are considered alongside your rights and interests. Booking confirmations and requested access/recovery emails are service communications. Acknowledging this privacy notice is not consent to marketing. Any separate consent-based activity must explain its purpose and how to withdraw consent. The contact and booking details marked as required are needed to process and manage an online booking or package; without them the online transaction cannot be completed. Contact Studio 95 if you need help. Payments and service providers Stripe processes card payments for Studio 95 through its connected account. Card details are entered into Stripe's payment interface; Pepperseed does not receive or store complete card numbers or card security codes. Stripe may act independently for payment security and compliance under its own privacy information: https://stripe.com/privacy. PEPPERSEED LTD supplies the booking software and normally processes Studio 95 booking information on the business's behalf. Pepperseed separately explains its own platform, security and account processing at https://www.pepperseed.co.uk/privacy. Contact Pepperseed at info@pepperseed.co.uk for information about processing for which it is responsible. Pepperseed uses Supabase for booking data and authentication, Vercel for application hosting and delivery, and Resend for transactional email. Authorised Studio 95 users and Pepperseed support staff may access information where needed to provide or support the service. Necessary records may also be shared with advisers, regulators or authorities where lawful. Studio 95 does not publish customer contact details as part of the booking page. This notice does not authorise sharing booking details for advertising. International processing Pepperseed's Supabase database and authentication project is hosted in London, United Kingdom. Supabase explains that support and operational processing may also involve Singapore and the United States, with logs held in the EU and content delivered through a global network. Its published Data Processing Addendum incorporates Standard Contractual Clauses and a UK Addendum for applicable restricted transfers: https://supabase.com/legal/customer-resources/data-processing-addendum. Pepperseed's current Vercel application deployment runs in the United States. Application requests therefore involve US processing even though the main database is in the UK. Pepperseed uses Vercel Pro. Vercel's Data Processing Addendum applies to Pro customers and incorporates the Standard Contractual Clauses together with the UK international data transfer addendum for applicable UK transfers. These safeguards cover transfers to Vercel in the United States; the applicable controller-to-processor or processor-to-processor clauses depend on the processing relationship. The DPA and UK addendum can be read or obtained at https://vercel.com/legal/dpa (Schedules 3 and 5). Resend sends Pepperseed email through its configured Ireland region, but states that message content and delivery records are stored in the United States. Resend states that its DPA applies to every account and includes Standard Contractual Clauses with the UK Addendum for UK transfers. See https://resend.com/security/gdpr and https://resend.com/legal/dpa. Choosing an Irish sending region does not keep stored email data in Ireland. Stripe processes payment information internationally under its own privacy information and applicable data-transfer terms. See https://stripe.com/privacy and https://stripe.com/legal/dpa. This notice does not promise that all payment processing stays in the UK. You can read the published safeguard documents at the links above or contact Studio 95 or info@pepperseed.co.uk to request information about the applicable safeguards and how to obtain a copy. Provider processing locations and subprocessors can change; we do not guarantee that all information remains in the UK. Retention and deletion How long information is needed depends on the record and purpose: whether you have an upcoming appointment, usable package or unresolved refund; the booking/customer relationship; security or dispute needs; and applicable legal, tax and accounting obligations. Package expiry stops further spending of expired credits; it does not delete purchase history or cancel appointments validly booked before expiry. Access-link expiry does not delete your booking or financial record. Requested package recovery links expire after 15 minutes and the resulting access session lasts one hour; these are access-security limits, not customer-record deletion periods. There is no universal automatic deletion date for all bookings, customers or package ledgers in the existing platform. Deletion or minimisation requests are assessed against outstanding appointments, purchased rights, refunds, disputes and justified record-retention needs. Where deletion is appropriate, Studio 95 can instruct Pepperseed to assist with removal or restriction through controlled procedures; deletion is not promised to happen automatically when a link, appointment or package expires. Provider copies and backups require separate controlled handling. We use these criteria rather than a single deletion period for every type of record. Contact Studio 95 if you want to know why a particular record is still needed or request deletion. Your rights Depending on the circumstances, you may request access, correction, erasure, restriction or portability of your personal information. You may withdraw consent where processing relies on consent without affecting earlier lawful processing. You have the right to object to processing based on legitimate interests. Tell Studio 95 about your circumstances so the request can be considered. Contact Studio 95 using the details above. We may ask for proportionate information to verify your identity and locate the relevant booking. Rights are subject to applicable legal conditions; a retention need is assessed rather than treated as a blanket refusal. Pepperseed can assist Studio 95 or respond separately where it is responsible. You may complain to the Information Commissioner's Office at https://ico.org.uk/make-a-complaint/ or call 0303 123 1113. You do not have to complain to Studio 95 first, although we welcome the opportunity to help. Changes If the use of your information changes materially, updated privacy information will be provided. Pepperseed retains the document versions recorded for the relevant transaction.