Privacy notice
Last updated: 4 October 2026
Who we are
TO Nails & Spa runs nail studios at 29 Market Street, Warwick CV34 4DH and 10 High Street, Studley B80 7HJ. The data controller is TO NAILS SPA LIMITED, a company registered in England (company number 14916509), registered office 29 Market Street, Warwick CV34 4DH. You can contact us about your data at tonailsspa.rhyme002@passmail.com or by calling either studio.
What we collect
On this website, we only collect personal data when you choose to send it through the “Stay in touch” form:
your name and email address
your mobile number, if you give it
your preferred studio
whether you want marketing emails (the box is unticked unless you tick it)
This website has no customer accounts and does not take bookings or payments. When you message us on Instagram or Messenger, or call a studio, those conversations are handled by those services and are not stored by this website.
When you have a treatment at a studio, we record the bill: the treatments and prices, who did them, how you paid and when. If you are happy to give them, we also keep your name, mobile number or email address with it so we can recognise you next time. This is optional. We ask whether you want to hear about offers, and only send them if you say yes.
Why we use it
To reply to you and keep you updated about what you asked about. Our lawful basis is our legitimate interest in answering enquiries.
To send marketing emails or texts, only if you ticked the box or said yes at the studio. Our lawful basis is your consent, which you can withdraw at any time by replying to any message or contacting us.
To keep the business and VAT records the law requires of what we sell. Our lawful basis is our legal obligation.
To recognise returning customers from the contact details they gave us at a studio. Our lawful basis is our legitimate interest in looking after our regular customers.
Who can see it
Your details can be seen by the owner and staff we authorise, through a password-free staff area protected by email sign-in codes. We use these service providers to run the website:
Supabase, which stores the form data and studio bills in its London (UK) region
Cloudflare, which hosts the website and runs Turnstile, a check that stops spam form submissions and processes technical information about your device and connection
We do not sell your data or share it with anyone for their own marketing.
How long we keep it
We keep enquiry details for 24 months after our last contact with you and then delete them. If you ask us to delete your details sooner, we will.
We keep bills for 6 years, because HMRC requires it. If you ask us to, we remove your name and contact details from them sooner; the bills themselves stay. We remove the contact details of customers who have not visited for 3 years.
Your rights
You have the right to ask for a copy of your data, to have it corrected or deleted, to restrict or object to how we use it, and to withdraw consent to marketing. Contact us using the details above and we will respond within one month.
If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office: ico.org.uk or 0303 123 1113.
Cookies
This website does not use advertising or analytics cookies. The staff area uses cookies that are strictly necessary to keep staff signed in.
Links to other sites
Links to Instagram, Facebook, Messenger, Google Maps and Apple Maps take you to those services, whose own privacy policies apply.
Changes to this notice
We will update this page if the way we use your data changes. The date at the top shows when it was last updated.