Privacy notice
Last updated: [DATE]. Version 0.1 (draft).
This notice explains what personal information Cut Cares collects, why we need it, how long we keep it and what you can ask us to do with it. It covers the website, the Cut Cares app, and what happens during a visit to your home.
We have tried to write it in plain language. If anything here is unclear, please ask us — being hard to understand is a fault in the notice, not in the reader.
1. Who we are
Cut Cares is a trading name of [COMPANY NAME] Ltd, registered in England and Wales, company number [NUMBER], registered office [REGISTERED ADDRESS].
For the information described in this notice we are the data controller — we decide what is collected and why. We are registered with the Information Commissioner’s Office under registration [ICO NUMBER].
Data protection contact: [NAME / ROLE], privacy@cutcares.uk, or write to us at [POSTAL ADDRESS].
2. What we collect and why
Under UK data protection law we have to have a specific reason — a “lawful basis” — for every piece of information we hold. Here is the whole list.
| What | Why we need it | Lawful basis |
|---|---|---|
| Your name, email address, phone number and password | To create your account, let you sign in, and contact you about a booking | Performance of a contract |
| Your address | The barber has to know where to come, and check-in is verified against it | Performance of a contract |
| Access needs and anything you tell us about your health or disability | So the person visiting you arrives prepared and the visit actually works for you | Explicit consent (Article 9(2)(a)) — you choose whether to tell us, and can withdraw it |
| Bookings, services, prices, payment status | To provide and bill for the service, and to meet our accounting obligations | Contract, and legal obligation for financial records |
| Photographs taken during a visit — see section 3 | To evidence that the visit happened, and to protect both you and the barber if something is disputed | Explicit consent, plus our legitimate interest in safeguarding — see section 3 |
| A four-digit check-in code, held for a single visit | So you can confirm the person at your door is the person we sent | Legitimate interests (your safety) |
| The barber’s approximate location at check-in and check-out | To confirm the visit took place at your address, not somewhere else | Legitimate interests (safeguarding and fraud prevention) |
| Ratings and reviews you write | To help other people choose, and to let us act on poor service | Legitimate interests |
| Sign-in records, IP address, device and browser information | Security — spotting account takeover and abuse | Legitimate interests (security) |
| A PIP or other disability benefit reference, if you give us one | Only to confirm eligibility for reduced-cost or volunteer visits | Explicit consent — it is always optional |
Information about your health or disability is special category data, which the law protects more strictly. We ask for it only where it changes the service you get, we never require it to make a booking, and you can remove it from your account at any time.
3. Photographs taken during a visit
This is the most sensitive thing we do, so it gets its own section.
When a barber arrives and again when they finish, the app records two timestamped photographs. This exists to protect you: it is the record that someone came, at the time claimed, to the right address, and that the work was done. It also protects the barber against a false allegation.
What is photographed
- On arrival, the barber is asked to photograph the front door or house number. The prompt in the app says explicitly that nobody needs to be in the shot.
- On completion, a photograph of the finished haircut. You decide whether that includes your face, and you can decline it entirely — the visit completes either way.
Your control over it
- You can refuse any photograph, at the time, without giving a reason and without affecting the service or the price.
- You can ask us to delete a photograph afterwards. Email privacy@cutcares.uk and we will remove it, unless it is the subject of an open safeguarding or insurance matter — in which case we will tell you that, and why.
- Photographs are never used for marketing, never published, and never shown to anyone outside the people listed in section 7.
Where a photograph shows an identifiable person and reveals information about their health or disability, we treat it as special category data and rely on your explicit consent. That means it must be a real choice, and withdrawing it must be as easy as giving it.
4. Body-worn cameras
Some barbers on the platform have registered a body-worn camera and their profile says so. Please read that badge carefully, because it means exactly what it says and nothing more:
- It means the barber has told us they wear one and we have recorded that.
- It does not mean a recording is being made, and it does not mean Cut Cares receives, stores or can access any footage. We have no technical way to confirm a physical device is switched on.
- Any footage a barber records is held by that barber, who is responsible for it under data protection law in their own right. If you want a copy, or want it deleted, ask them. If you cannot get a satisfactory answer, tell us and we will take it up with them.
If a barber records you and you do not want them to, say so. They must stop.
5. Location during check-in
When a barber checks in, the app asks their device for its location and compares it with your address. If it is within about 75 metres, check-in proceeds normally.
- This is the barber’s location, not yours. We do not track your device, and the app never asks a customer for location.
- 75 metres is not precise enough to distinguish neighbouring houses, and the app says so on screen. It is there to show the barber was at your street, not across town.
- If the barber refuses the location permission, or the reading is poor, check-in still works through the code and the photograph. No part of the visit depends on it.
6. Barber background checks
Every barber on the platform holds an Enhanced DBS check. Cut Cares holds the certificate number, the issue date, and whether the check is still current — never its contents. The Update Service tells us only that a certificate is unchanged or that a fresh one is needed; it does not disclose convictions to us, and we could not display them if we wanted to.
If you are a barber, this section is about you: we also hold your qualification and insurance documents, your payout details, and the record of admin decisions on your account. We check your DBS status only with your consent, which we ask for each time.
7. Who we share information with
We do not sell personal information, and we do not share it for anyone else’s marketing. It goes to:
- The barber attending your visit
- Your name, address, phone number, the service booked, and any access needs you chose to share. They do not receive your check-in code — the code exists so that you can verify them.
- Our hosting and storage providers
- [HOSTING PROVIDER] for the servers and Cloudflare R2 for photographs, both acting only on our instructions under a written contract.
- Our payment provider
- [PAYMENT PROVIDER] processes card payments. Card details go to them directly and are never held by Cut Cares.
- The DBS umbrella body
- [UMBRELLA BODY] carries out barber background checks. This concerns barbers only.
- Safeguarding authorities
- If we have a genuine concern that someone is at risk of harm, we may pass information to the local authority safeguarding team, the police, or another appropriate body. We will tell you when we do this unless telling you would increase the risk.
8. Where your information is stored
Servers and photograph storage are located in the United Kingdom or the European Economic Area. We do not transfer personal information to the United States or other countries without an adequacy decision.
9. How long we keep it
We keep information only as long as we actually need it.
| What | How long |
|---|---|
| Your account | While it is open, then [PERIOD] after you close it |
| Visit photographs | [PERIOD — to be set by the DPIA] |
| Check-in codes | Deleted when the visit ends |
| Booking and payment records | Six years, as required for UK tax records |
| Sign-in and security logs | [PERIOD] |
| Barber verification records | [PERIOD] after the barber leaves the platform |
The retention period for photographs is the single most important number in this notice, and we are not going to guess at it. It is being set by our data protection impact assessment and will be published here before we begin taking photographs in service.
10. Your rights
Under UK GDPR you can ask us to:
- Show you what we hold about you, and give you a copy.
- Correct anything that is wrong.
- Delete your information, where we do not have to keep it.
- Stop or limit what we do with it.
- Move it to another service in a machine-readable form.
- Object to processing based on our legitimate interests.
- Withdraw consent at any time — including consent to photographs, and to anything you told us about your health. Withdrawing it does not undo what we did beforehand, but it stops us going further.
Email privacy@cutcares.uk. We will reply within one month. There is no charge. You can make a request by phone or in person if writing is difficult — ask us and we will take it down for you and read it back.
11. If someone books on your behalf
A relative, carer or support worker can book a visit for you. When that happens the information is still about you, and the rights in section 10 are yours, not theirs.
- We record who made the booking and their relationship to you.
- Consent to a photograph is yours to give at the time of the visit. Someone else cannot give it for you unless they hold a legal authority — a lasting power of attorney or a deputyship — and we will ask about that.
- You can contact us directly at any time, and ask us to deal only with you.
12. How we protect it
- Everything travels over an encrypted connection, and photographs are stored encrypted.
- Passwords are hashed with argon2id. Nobody at Cut Cares can read your password.
- Access to photographs is restricted, time-limited and logged — every view is recorded against the person who viewed it.
- A barber’s view of a visit deliberately excludes your check-in code.
13. Cookies
This website sets no advertising or analytics cookies, and there is no consent banner because there is nothing to consent to.
The app sets two cookies once you sign in: one to keep you signed in, and one to protect the forms you submit from being forged by another site. Both are strictly necessary and neither tracks you anywhere else. Your theme and reading preferences are stored on your own device and never sent to us.
14. Complaints
If you are unhappy with how we have handled your information, please tell us first at privacy@cutcares.uk so we can put it right.
You also have the right to complain to the Information Commissioner’s Office at any time: ico.org.uk/make-a-complaint, or 0303 123 1113.