BarberDesk← Back to homepage

Privacy Policy

Last updated: [DATE]

This Privacy Policy explains how [COMPANY NAME] Ltd (company number [TBC]), registered in England and Wales ("BarberDesk", "we", "us", "our"), handles personal data in connection with the BarberDesk platform.

BarberDesk plays two different roles depending on whose data is involved, and this Policy is structured around that distinction. Please read Section 1 first, as it determines which parts of this Policy apply to you.

1. Our two roles: controller and processor

When we are the controller. For the personal data of barbershop owners and their staff who hold BarberDesk accounts — for example, account details, billing information, and support correspondence — BarberDesk is the data controller. Sections 2 to 9 describe how we handle that data, and Sections 11 to 15 contain further information that applies generally.

When we are the processor. For the personal data of a barbershop's own customers — for example, the names, contact details, and booking history that a shop collects when taking bookings — the barbershop is the data controller and BarberDesk is the processor. This means the shop decides how that data is used, and we only process it on the shop's behalf and instructions. Section 10 describes this. If you are a customer of a barbershop and have questions about your data, you should contact the shop directly; we explain this further in Section 10.

2. Data we collect as controller (Shop accounts)

When you sign up and use BarberDesk as a barbershop owner or member of staff, we collect:

  • Account information: your name, email address, phone number, shop name, shop address, and login credentials.
  • Billing information: your subscription details and payment records. Card details themselves are collected and stored by our payment provider, Stripe, not by us.
  • Usage information: how you interact with the dashboard, features you use, and technical data such as device and browser information and log data.
  • Support information: the content of any messages you send us.

3. How we use this data and our lawful bases

We use Shop account data to:

  • provide and operate the platform (lawful basis: performance of our contract with you);
  • take payment and manage your subscription (lawful basis: performance of our contract with you);
  • provide support and respond to your queries (lawful basis: performance of our contract, and our legitimate interests in supporting our users);
  • keep the platform secure and prevent misuse (lawful basis: our legitimate interests in protecting the platform and its users);
  • send you service messages such as booking, billing, and security notifications (lawful basis: performance of our contract);
  • send you product updates or marketing, where permitted (lawful basis: your consent or our legitimate interests, and you can opt out at any time);
  • comply with our legal obligations, such as tax and accounting requirements (lawful basis: legal obligation).

4. Sharing your data

We share Shop account data only where necessary:

  • with our sub-processors and service providers who help us run the platform (see Section 8);
  • with professional advisers, such as accountants or lawyers, where reasonably needed;
  • with authorities or third parties where required by law, or to protect our rights or the safety of others;
  • with a buyer or successor if we sell or reorganise our business, subject to appropriate protections.

We do not sell your personal data.

5. How long we keep it

We keep Shop account data for as long as your account is active and for a reasonable period afterwards to meet legal, tax, and accounting obligations, resolve disputes, and enforce our agreements. When we no longer need it, we delete or anonymise it.

6. Your rights

Under UK data protection law you have the right to access your data, to have inaccurate data corrected, to have data erased in certain circumstances, to restrict or object to certain processing, to data portability, and to withdraw consent where processing is based on consent. You can exercise these rights by contacting us at support@barberdesk.co.uk.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk. We would appreciate the chance to address your concerns first.

7. Security

We take reasonable technical and organisational measures to protect personal data, including access controls that separate each shop's data from every other shop's, encryption in transit, and use of reputable infrastructure providers. No system is completely secure, but we work to protect data against unauthorised access, loss, or misuse, and we maintain measures to keep shops walled off from one another's data.

8. Sub-processors and service providers

We use the following third parties to provide the platform. They process personal data on our behalf under appropriate agreements:

  • Supabase — database and authentication (data hosting).
  • Stripe — payment processing and subscription billing.
  • Resend — sending transactional emails (such as booking and account emails).
  • Vercel — application hosting.
  • Twilio — sending SMS and WhatsApp messages (where these features are used).
  • AI service providers — where AI features are used to help draft, send, or manage communications with customers (such as answering booking enquiries or sending reminders), a third-party AI provider may process the relevant message content to generate responses on the shop's behalf. AI providers act on our and the shop's instructions and do not use this data to train their own models where we can prevent it by contract.

We may update this list as our services evolve. Where a sub-processor processes data outside the UK, we put appropriate safeguards in place as required by UK data protection law.

9. International transfers

Some of our service providers may process data outside the UK. Where they do, we rely on appropriate safeguards recognised under UK data protection law, such as adequacy decisions or standard contractual clauses, to protect your data.

10. Customer data — where the shop is the controller

When a barbershop uses BarberDesk to take bookings, it collects personal data about its own customers, such as their name, contact details, appointment history, and any deposit or no-show payment records.

For this data:

  • the barbershop is the data controller — it decides why and how the data is used;
  • BarberDesk is the processor — we store and process the data only to provide the platform to the shop, and only on the shop's instructions, as set out in our Data Processing Agreement;
  • if you are a customer of a barbershop and want to access, correct, or delete your data, or have questions about how your data is used, you should contact the barbershop directly, as they control that data. If you contact us, we will where appropriate direct your request to the relevant shop.

BarberDesk does not use barbershop customers' personal data for its own purposes, and does not sell it.

11. AI-assisted communications

Some BarberDesk features use artificial intelligence to help shops communicate with their customers — for example, to help answer booking enquiries, draft replies, or send reminders and follow-up messages.

Where these features are used:

  • the AI processes the information needed to generate a relevant message, such as booking details and the content of a customer's message;
  • for a barbershop's own customers, the shop remains the controller of that data and BarberDesk (with its AI providers) acts as processor, using the data only to provide the feature on the shop's behalf;
  • we do not use AI to make decisions that produce legal or similarly significant effects about a person without appropriate safeguards;
  • we work with AI providers under terms intended to prevent your data being used to train their models, where that is within our control.

A shop that enables AI communication features is responsible, as controller, for informing its customers that some messages may be generated or assisted by AI, where appropriate.

12. Cookies

We use cookies and similar technologies as described in our Cookie Policy.

13. Children

BarberDesk is intended for use by businesses. We do not knowingly collect personal data directly from children through the Shop account side of the platform. Where a barbershop books an appointment involving a minor, the shop is responsible, as controller, for handling that data lawfully.

14. Changes to this Policy

We may update this Policy from time to time. If a change is significant, we will give notice by email or through the platform. The "last updated" date at the top shows when it was last revised.

15. Contact

For any privacy question, or to exercise your rights, contact:

support@barberdesk.co.uk

[COMPANY NAME] Ltd [REGISTERED ADDRESS] Company number [TBC]

This document is a template prepared for BarberDesk and is not legal advice. It should be reviewed by a qualified solicitor before publication, particularly the controller/processor split, sub-processor list, and international transfer wording.