PrivacyYour information, looked after
What we collect, why, how long we keep it, and your rights. Last updated October 2026.
Who we are
Sandra's Organic Beauty, Street name 00, Larnaca, Cyprus, is responsible for your information. For anything about your data, email hello@sandrasorganicbeauty.com or message +357 99 910048.
What we collect and why
Your name, phone, email, bookings, purchases and notes, so we can book and carry out your treatments, take payment and send reminders. This is needed to provide the service you ask for (GDPR Article 6(1)(b)). Receipts are kept because the law requires it (Article 6(1)(c)). Analytics, marketing messages and rewards only happen if you agree (Article 6(1)(a)).
Health information
Some treatments, such as microneedling, permanent makeup, massage, waxing and tints, need a few health questions first so Sandra can keep you safe. Health information is special category data, so we only collect it with your explicit consent (GDPR Article 9(2)(a)), given by ticking a separate box that is never pre-ticked.
- We only ask the questions that matter for the treatment you book.
- You can choose to answer in person at the studio instead of online.
- Your answers are encrypted before they are stored, kept in the EU, and kept apart from your booking.
- Only Sandra can open them. Opening a form asks for her password again and every view is logged.
- They are never sent by email or WhatsApp, never used for marketing and never shared.
- Answers are valid for 12 months; after that we ask again.
- They are deleted 2 years after your last visit.
- Some answers mean a treatment can't be booked online. You'll see this straight away, nothing is charged, and Sandra will talk it through with you.
- We deliberately do not ask about HIV or hepatitis. The same hygiene standards apply to every client.
- You can withdraw consent at any time from Manage my data. We will delete your answers and go through the questions in person at your next visit.
- If you have had a treatment, the signed consultation and treatment record is kept for as long as our insurer requires to deal with a possible claim, even if you withdraw consent, because the law allows records needed for legal claims to be kept (GDPR Article 9(2)(f)). It is used for nothing else.
Age and photos
Online booking is for adults. Clients under 18 book with a parent or guardian, who signs the consent in person; permanent makeup and microneedling are 18 and over only.
Before and after photos are only taken with your permission, and you choose separately whether they stay in your record only or can also be shown on the website and Instagram without your name. You can change either choice at any time.
How long we keep it
- Health answers
- 2 years after your last visit, then deleted automatically
- Signed treatment records
- Kept for as long as our insurer requires to deal with a possible claim
- Before and after photos
- Until you withdraw consent, or 2 years after your last visit
- Patch test results
- 6 months for booking, then with your treatment record
- Bookings and receipts
- As long as Cyprus tax and accounting law requires
- Waitlist entries
- 30 days, or until you book
- Rewards account
- Until you close it, or 2 years without a visit
- Marketing messages
- Until you unsubscribe
- Cookie choices
- 12 months, then we ask again
Who helps us
These services process data for us under data processing agreements. Where data leaves the EU it is protected by approved safeguards such as the EU Standard Contractual Clauses.
- Supabase
- Booking, client and encrypted health records, hosted in the EU
- Stripe
- Deposit and priority payments
- Shopify
- Online shop, packages and in-studio sales
- Twilio and WhatsApp
- Appointment reminders and messages
- Resend
- Emails and receipts
- Cloudflare
- Hosting the website
- Smile.io
- Rewards points
- Google Analytics
- Visit statistics, only if you accept analytics cookies
Your rights
You can ask to see your data, correct it, delete it, limit how we use it, get a copy to take elsewhere, object to its use, and withdraw any consent. Do most of it yourself from Manage my data (we send a code to your WhatsApp first so nobody else can), or message or email us and we will reply within one month. We never make automated decisions about you.
If you are unhappy with how we handle your data you can complain to the Commissioner for Personal Data Protection in Cyprus.
Cookies
Essential cookies keep bookings and the shop working. Analytics and marketing cookies only load if you accept them, and you can change your choice any time from Cookie settings at the bottom of every page.