Last updated: 21 October 2026
Who is responsible for your information
Victoria Cheek, trading as Victoria Cheek Skin Specialist, is the data controller responsible for deciding how and why personal information is used.
Contact details
Victoria Cheek Skin Specialist
Leigh-on-Sea, Essex
Email: vcheekskincare@gmail.com
The full business correspondence address is available where reasonably required for data-protection correspondence but is not published online because the treatment space is also a private home.
Information we may collect
We may collect:
- Your name
- Email address
- Telephone number
- Information included in an enquiry
- Appointment and booking information
- Payment and transaction records
- Relevant consultation, treatment and aftercare information provided in connection with a booked service
- Technical information needed to operate and secure the website
- Communication preferences where applicable
Please do not send detailed medical information through the general website contact form.
How personal information is collected
Personal information may be collected when you contact Victoria through the website, email, telephone, text, WhatsApp or Instagram; arrange an appointment directly with Victoria; complete the skincare questionnaire using the private link sent after your first appointment has been arranged; attend a treatment; purchase a product; or communicate before or after an appointment.
Why information is used
Personal information may be used to:
- Respond to enquiries
- Arrange and manage appointments
- Provide treatments safely and appropriately
- Maintain treatment and aftercare records
- Recommend appropriate homecare
- Process and record payments
- Manage cancellations or appointment changes
- Meet accounting, insurance and legal obligations
- Protect the website and prevent misuse
- Send marketing only where appropriate permission has been obtained
Lawful bases
Depending on the situation, information may be used because:
- It is necessary to take steps at your request before providing a service
- It is necessary to provide and manage a booked service
- Victoria has a legitimate business interest in responding to enquiries, keeping appropriate records and operating the business
- There is a legal obligation to keep particular information
- You have given consent, including explicit consent where required for relevant health information or direct marketing
Where processing relies on consent, you may withdraw that consent at any time. Withdrawal does not make earlier lawful processing invalid.
Health and treatment information
Information about health, medication, allergies or skin conditions may be needed to assess treatment suitability and provide services safely. This information is treated with additional care and is only collected where relevant.
Where required, explicit consent will be obtained for processing this information. It will not be used for unrelated marketing.
Website enquiries
Victoria uses the contact details and message you provide to respond to your enquiry, discuss services and arrange appointments where requested. Responding to an enquiry does not rely on separate data-processing consent.
Where you ask Victoria to arrange an appointment or take another step before receiving a service, the lawful basis is taking steps at your request before entering into a contract. Where an enquiry is general and not connected to arranging a service, the lawful basis may be Victoria’s legitimate interest in responding to genuine business enquiries.
Contact-form information is not used for unrelated marketing without separate permission. Submitting an enquiry does not add you to a mailing list or trigger a promotional email. Please do not include detailed medical or sensitive health information through the general enquiry form.
Enquiries are processed securely and stored in the existing private enquiry system. Access is restricted; enquiries cannot be read by other website visitors. Your selected enquiry type, if supplied, is included with your message. Resend acts as the email-delivery service for enquiry notifications sent to Victoria, with your validated email address used as the Reply-To address so she can respond personally.
Cloudflare Turnstile protects the form from spam and automated misuse. Its automated bot check uses basic device and connection information to help distinguish genuine visitors from automated programs.
Who information may be shared with
Information may be shared only where reasonably necessary with:
- The services currently used to host this website and securely process and store enquiries
- Cloudflare, whose Turnstile service performs the automated bot check on the enquiry form
- Resend, which delivers website enquiry notifications to Victoria
- Email and communication services when you contact Victoria through them
- Payment, accounting or professional service providers where used for your purchase or treatment
- Insurers, regulators or authorities where legally required
Personal information is not sold.
Service providers are expected to handle information securely and only for the relevant service.
International transfers
Some technology providers may process information outside the United Kingdom. Where this happens, reasonable steps will be taken to ensure appropriate protections are in place.
Retention
Information is kept only for as long as reasonably needed for the purpose for which it was collected.
The initial retention approach is:
- Enquiries that do not lead to an appointment: normally up to 12 months after the last meaningful contact
- Contact-form and routine correspondence: normally up to 24 months after the last meaningful contact where an ongoing client relationship exists
- Consultation and treatment records: retained for the period reasonably needed for safe ongoing care, insurance requirements and the establishment or defence of legal claims
- Appointment and transaction records: retained for the period required for accounting, tax, contractual and legal obligations
- Marketing preferences: retained until consent is withdrawn or the information is no longer required
- Website security records: retained only for the period reasonably necessary to investigate and prevent misuse
Information may be deleted earlier where it is no longer needed. Retention periods will be reviewed periodically and adjusted where insurance, legal or professional requirements require a different period.
Security
Reasonable organisational and technical measures are used to protect personal information against loss, misuse, unauthorised access or disclosure.
No online system can be guaranteed completely secure, but access is limited to those who reasonably need the information.
Your rights
Depending on the circumstances, you may have the right to:
- Ask for access to your personal information
- Ask for inaccurate information to be corrected
- Ask for information to be deleted
- Ask for use of information to be restricted
- Object to particular uses
- Ask for information to be transferred
- Withdraw consent where processing relies on consent
- Complain about how your information is handled
To make a request, contact:
Identity verification may be requested before disclosing personal information.
Complaints
Please contact Victoria first so that any concern can be addressed.
You may also complain to the Information Commissioner’s Office:
Information Commissioner’s Office: make a complaint
Changes to this policy
This policy may be updated when services, technology or legal requirements change. The latest version will be published on this page with its revision date.