Privacy Policy
Last updated: 27 July 2026
1. Who we are
Colour by Shann is the trading name of Shannon Harford, a sole trader operating from London, England. For the purposes of UK data protection law, Shannon Harford is the controller of the personal information described in this policy.
You can contact us about anything in this policy at gday@colourbyshann.com.
This policy explains what information we collect, why we use it, the lawful bases we rely on, who we share it with, how long we keep it, and the rights you have.
2. The information we collect
We collect only the information we need to run the service. Depending on how you interact with us, this may include:
- Enquiry information. Your name, email address, the nature of your enquiry and the message you send through our contact form or by email.
- Booking information. Your name, contact details, appointment date, service booked, payment status and any correspondence about your booking.
- Consultation records. Notes made during or after your appointment, such as the colour characteristics observed, your seasonal result and the guidance provided, so that we can prepare your materials and assist you afterwards.
- Information you choose to share for your comfort and safety. If you tell us about accessibility requirements, allergies or sensitivities so that we can adapt your appointment, we record only what is needed to look after you.
- Technical information. Limited, privacy-preserving analytics about visits to our website (described in section 7), and security information processed when you submit our contact form.
We do not knowingly collect information from children. Appointments must be booked by an adult, and anyone under 18 must be accompanied by an adult.
3. Why we use your information, and our lawful bases
| Purpose | Lawful basis |
|---|---|
| Replying to your enquiry | Legitimate interests (responding to a message you have chosen to send us) |
| Arranging, delivering and administering your appointment, including preparing your palette and take-home materials | Performance of a contract |
| Recording accessibility, allergy or sensitivity information you volunteer so that your appointment is safe and comfortable | Your explicit consent, which you may withdraw at any time |
| Keeping business and accounting records | Legal obligation |
| Protecting our website from spam and abuse | Legitimate interests (keeping the service secure) |
| Sending marketing, if you ever opt in | Consent, which you may withdraw at any time |
Booking an appointment or sending an enquiry never signs you up to marketing. If we introduce a newsletter, joining it will always be a separate, active and optional choice, with an unsubscribe link in every message.
4. Who we share information with
We never sell your personal information. We share it only with the service providers who help us operate, each acting under contractual obligations to protect it:
- Cloudflare, Inc. hosts our website, provides our privacy-preserving analytics and protects our contact form from abuse (Turnstile).
- Resend, Inc. delivers the email notification generated when you submit our contact form.
- Our email provider stores the mailbox in which your emails to us are received and answered.
We may also disclose information where the law requires it, or where necessary to establish, exercise or defend legal claims.
5. International transfers
Some of our providers process information on servers outside the United Kingdom, including in the United States. Where this happens, the transfer is protected by safeguards recognised under UK data protection law, such as the UK Extension to the EU–US Data Privacy Framework or the UK International Data Transfer Agreement, together with each provider’s own security measures.
6. How long we keep information
- Enquiries that do not lead to a booking are kept for up to 12 months, then deleted.
- Booking records and consultation notes are kept for up to 24 months after your appointment, so that we can answer follow-up questions and honour our commitments to you, unless you ask us to delete them sooner.
- Accessibility, allergy or sensitivity information is deleted once it is no longer needed for your appointments, or immediately on request.
- Records we must keep by law, such as basic accounting records, are kept for the period required by HM Revenue & Customs, currently at least five years after the relevant tax filing deadline.
7. Analytics
We use Cloudflare Web Analytics, a privacy-first measurement tool. It does not use cookies, does not fingerprint your device and does not track you across other websites. It shows us only aggregate information, such as which pages are read and roughly where in the world visitors are, so that we can improve the site.
8. Your rights
Under UK data protection law you have the right to:
- Ask for a copy of the personal information we hold about you.
- Ask us to correct inaccurate information.
- Ask us to delete your information, where no legal obligation requires us to keep it.
- Ask us to restrict or object to particular uses of your information.
- Receive information you provided to us in a portable format.
- Withdraw any consent you have given, at any time, without affecting the service you receive.
To exercise any of these rights, email gday@colourbyshann.com. We will respond within one month.
You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113, although we would welcome the chance to resolve any concern with you first.
9. Security
Our website is served entirely over HTTPS. Access to personal information is limited to Shannon Harford and the service providers listed above, and we collect the minimum information needed for each purpose. No photograph, consultation record or personal detail is ever published without your separate, explicit consent.
10. Changes to this policy
We may update this policy as our services or legal obligations change. The date of the latest version appears at the top of this page, and significant changes will be highlighted on this page.