Privacy Policy

1. Administrator and contact

The organisation responsible for the personal information described in this policy is Whitevelour Works Pty Ltd, located at 47 Chapel Street, Prahran VIC 3181, Australia. In GDPR terminology, we act as the data controller where we determine why and how personal data is processed.

Questions, requests and complaints concerning privacy may be submitted using the contact details above. We will take reasonable steps to verify the identity of a requester before disclosing, correcting or deleting personal information.

2. Scope and applicable standards

This policy applies to personal information collected through the Whitevelour Works website, appointment and enquiry processes, consultations, newsletter interactions and direct communications. Our Australian operations are guided by the Privacy Act 1988 (Cth), the Australian Privacy Principles and applicable health, consumer and record-keeping obligations. Where the GDPR applies because we offer services to, monitor, or otherwise process the personal data of people in the European Economic Area, we also apply the GDPR requirements described in this policy.

This policy does not govern independent websites, platforms or services that we do not control. The website is designed for adults and is not intentionally directed to children.

3. Information we may collect

Depending on your interaction with us, we may collect:

• identity and contact information, such as your name, email address and telephone number;
• appointment and service information, including requested treatments, preferred dates, stylist or practitioner preferences and attendance history;
• enquiry content, correspondence, feedback and complaint records;
• health, allergy, sensitivity, medication, pregnancy or treatment history information that you voluntarily provide and that is reasonably necessary to assess service suitability;
• transaction and billing information, while full payment-card details are ordinarily processed by a payment provider rather than stored by this website;
• newsletter preferences and records of consent or withdrawal;
• technical information such as browser type, device category, approximate location derived from an IP address, access time, referring page, security logs and basic website diagnostics, where such data is generated by the hosting environment;
• cookie or local-storage choices described in our Cookie Policy; and
• any other information you choose to provide to us.

Information about health, skin conditions or other sensitive matters is treated with additional care. We request it only when it is relevant to safety, suitability, aftercare or legal obligations, and we rely on explicit consent or another lawful basis where required.

4. How information is collected

We may collect information directly from you when you complete a form, request an appointment, communicate with our team, visit the salon, subscribe to updates, purchase a product, provide consent or make a complaint. We may also receive limited information from authorised representatives, booking or payment providers, professional advisers, service providers, publicly available sources or technical systems used to secure and operate the website.

If you provide personal information about another person, you should have authority to do so and should make that person aware of this policy where appropriate.

5. Purposes and lawful bases

We process information only for legitimate and defined purposes, including to respond to enquiries; assess treatment suitability; arrange, deliver and follow up services; maintain client and safety records; process transactions; provide customer support; manage preferences; improve our services; protect the website and our premises; prevent fraud or misuse; comply with legal obligations; establish or defend legal claims; and send marketing communications where permitted.

Where the GDPR applies, the lawful basis may be performance of a contract or steps requested before a contract, compliance with a legal obligation, protection of vital interests, our legitimate interests in operating and securing the business, or consent. For special-category data, we rely on explicit consent, health-related necessity under applicable safeguards, legal claims or another permitted condition. You may withdraw consent at any time, without affecting processing that occurred before withdrawal.

6. Necessity, choice and consequences

You may browse most public website content without identifying yourself. Some information is necessary to respond to an enquiry, book or safely provide a treatment, issue records, process a payment or meet legal requirements. If required information is not provided, we may be unable to complete the requested action or may need to decline or modify a service for safety reasons.

Where practicable, you may interact anonymously or under a pseudonym, but this may not be possible for bookings, transactions, clinical or safety records, or where identification is required by law.

7. Sharing and disclosure

We do not sell personal information. We may disclose relevant information to employees and contractors who need it to perform their roles; booking, hosting, email, security, payment, accounting or professional service providers; insurers and advisers; regulators, courts, law-enforcement bodies or other recipients where required or authorised by law; and a successor in connection with a genuine corporate transaction.

Service providers are expected to use information only for agreed purposes, apply appropriate safeguards and maintain confidentiality. We disclose only the information reasonably necessary for the relevant function.

8. International transfers

Some service providers may store or access information outside Australia or outside the country in which you are located. Before using such providers, we assess the nature of the service and seek contractual, technical and organisational safeguards appropriate to the risk. Where the GDPR applies, transfers outside the EEA will rely on an adequacy decision, approved contractual safeguards, a permitted derogation or another lawful transfer mechanism.

Internet communications and international service infrastructure mean that absolute geographic isolation cannot always be guaranteed. You may contact us for further information about safeguards relevant to your information.

9. Retention

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including service delivery, safety follow-up, accounting, dispute resolution, insurance and legal compliance. Retention periods depend on the type of record, sensitivity, foreseeable need, legal limitation periods and mandatory record-keeping rules.

When information is no longer required, we take reasonable steps to delete, destroy or de-identify it. Backup copies may remain for a limited period until they are securely overwritten in the ordinary backup cycle.

10. Security and data breaches

We use proportionate administrative, physical and technical measures intended to protect information against loss, unauthorised access, misuse, interference, alteration or disclosure. Measures may include access controls, staff confidentiality, secure configuration, encryption where appropriate, minimisation, backups, logging, supplier review and incident-response procedures.

No system is completely secure. If a data breach occurs, we will investigate, contain and remediate it and will notify affected individuals and regulators where required, including under Australia’s Notifiable Data Breaches scheme or applicable GDPR rules.

11. Your privacy rights

Subject to applicable law and exceptions, you may request access to personal information, correction of inaccurate or incomplete information, deletion, restriction of processing, objection to certain processing, and a portable copy of information you provided in a structured format. You may also withdraw consent and object to direct marketing at any time.

Australian individuals may request access and correction and may complain about an alleged interference with privacy. EEA individuals may lodge a complaint with the supervisory authority in their place of residence, work or the place of the alleged infringement. We encourage you to contact us first so we can investigate and address the concern.

We generally do not charge for a reasonable request, but a permitted fee or refusal may apply where a request is manifestly unfounded, excessive, legally restricted or would adversely affect another person’s rights. We will explain any lawful refusal.

12. Automated decisions and profiling

We do not use this website to make solely automated decisions that produce legal or similarly significant effects. We may use ordinary administrative tools to organise enquiries, identify duplicate submissions, maintain security or record preferences. Any material treatment or service decision is reviewed by an appropriately authorised person.

13. Marketing communications

We send promotional communications only where permitted, including when you have consented or where a lawful existing-customer basis applies. Every electronic marketing communication should provide a practical way to opt out. You may also withdraw your preference by contacting us. Service, safety, booking and transactional messages are not marketing and may still be sent where necessary.

14. Cookies and website storage

The current website does not intentionally deploy advertising or behavioural analytics cookies. It may use strictly necessary browser storage for functions such as recording a newsletter preference on your device or maintaining security and interface behaviour. More information, including how to control browser storage, is provided in the Cookie Policy.

15. Changes to this policy

We may update this policy when our practices, technology or legal obligations change. The revised version will be published on this page with a new effective date. Material changes may also be communicated through an appropriate notice. Continued use of the website after publication does not remove any consent right or other protection provided by law.