Privacy Policy

This notice explains how SHY uses personal information when you visit our website, shop with us, contact the studio or book a service.

Who we are

SHY is operated by SF Flow State Ltd from 35 High Street, Lewes, East Sussex, BN7 2LU. For privacy questions, email contact@studioshy.co.uk or call 07907 981433.

Information we may collect

Depending on how you use SHY, this can include your name, contact details, delivery and billing information, order history, appointment information, messages you send us, marketing preferences and technical information about how you use the website.

Some treatments require consultation or health information. Where this is needed, it should be collected through the relevant secure booking, consultation or practitioner process rather than an ordinary website contact form.

Why we use it

We use personal information to provide products and services, manage orders and collections, respond to enquiries, administer appointments, keep appropriate business and financial records, prevent fraud, improve the website and communicate with you where we have permission or another lawful basis to do so.

Our lawful bases

Depending on the activity, we rely on performance of a contract, compliance with legal obligations, our legitimate interests in running and improving SHY, or consent. Where special-category information such as health information is required for a treatment, the relevant booking or practitioner process should provide the additional privacy information and lawful condition required for that processing.

Who we share information with

We use service providers to run SHY, including ecommerce and website services, appointment and client-management systems, payment providers, delivery services, email and communications services, analytics and other suppliers that support the business. We share only the information needed for those purposes and expect suppliers to protect it appropriately.

Some resident artists + therapists operate independent practices and use their own booking or payment systems. Where you book directly with an independent practitioner, they may be a separate controller of the information they collect and should provide their own privacy information where required.

International transfers

Some technology providers may process information outside the UK. Where this happens, we use providers and safeguards intended to protect personal information in accordance with applicable data-protection law.

How long we keep information

We keep information only for as long as it is needed for the purpose for which it was collected, to meet legal, tax, accounting, insurance or professional requirements, or to deal with disputes. Retention periods vary by record type.

Marketing

You can unsubscribe from marketing emails at any time using the link in the email or by contacting us. Service messages about an order or appointment are separate from marketing.

Your rights

Depending on the circumstances, UK data-protection law gives you rights to access, correct, erase or restrict use of your personal information, object to certain processing, request portability and withdraw consent where consent is relied on. Contact us if you want to exercise a right.

You can also complain to the Information Commissioner’s Office if you are unhappy with how personal information has been handled.

Cookies

Our website uses cookies and similar technologies. See our Cookie Policy and the cookie choices presented on the site.

Changes

We may update this notice when our services, suppliers or the law change. The latest version will be published on the website.