Privacy Policy

Information collected

We collect the following personal information when you use our site:

• First and last name: for identification and personalisation of our services.
• Email address: for communication about appointments, confirmations, reminders and, possibly, future communications.
• Phone number: when you provide it, to contact you about an appointment or a training application.
• Booking and application data: the service or course chosen, the date and time slot, the information you enter in our forms and, if you answer the optional question about how you heard of us, the channel you pick.
• Waiting list: your email address, the course you are interested in, the site language and, only if you tick the dedicated box, your phone number so we can call you back. We also keep a record of your agreement: its date and the version of the wording shown when you signed up.
• Where your visit came from: when you reach the site through a campaign link, two things are attached to your request: that link's parameters (source, medium, campaign) and the page you landed on. This tells us which channels bring in enquiries, and which page made someone want to write to us. The landing page is stored as the path alone, without the parameters in the address: those can carry a personal booking-management or unsubscribe link, which has no place in a statistic. All of this is recorded once only, on your first arrival, and only if the link already carries those parameters: an ordinary visit leaves none of it. We do not track the pages you view afterwards, we build no profile, and we sell nothing.

Payments are handled directly by our provider Stripe: we do not store your card details.

Methods of collection

We collect your personal information in different ways:

• Online forms: During registration, appointment booking, or information requests.
• Cookies and similar technologies: To improve your experience on our site. See section 4 for more details.

Cookies and similar technologies

We use two types of functional cookies to optimise your user experience:

• Preferred language cookie: This cookie remembers the language you have selected (fr-FR, en-US, ru-RU) and persists for 1 year.
• Site theme cookie: This cookie remembers the theme you have chosen (system, dark, light) and is stored in localStorage with no expiry.

These cookies do not collect directly identifiable personal data but help personalise and improve your user experience.

Session memory for where your visit came from: if you arrive through a campaign link, that link's parameters and the landing page are held in your browser's session memory (sessionStorage) for as long as it takes you to fill in a form, should you choose to. Nothing is stored there if the link does not carry those parameters, and everything disappears when you close the tab.

Audience measurement (Google Analytics 4): only with your consent, we use Google Analytics 4 to measure the site's audience (page views, booking and application journeys) in order to improve our services. No measurement cookie is set until you click "Accept" in the banner, and we never send directly identifying data (name, email, phone) to Google. Google Analytics cookies last at most 13 months. You can withdraw your consent at any time via the "Manage cookies" link in the footer.

Use of data

The information collected is used for:

• Appointment and application management: confirmation, reminders and cancellation of appointments, follow-up of training applications and reminders for files awaiting payment.
• Client communication: Responses to enquiries, important notifications regarding services.
• Waiting list: telling you when a new session opens, and nothing else. We neither sell nor rent this list, every message carries a one-click unsubscribe link, and being on the list is neither an enrolment nor a seat reservation.
• Phone call-back: if you ticked the matching box, calling you about upcoming sessions, within the hours allowed by law.
• Review request: after an appointment, we may invite you to leave a public review on our Google listing. We ask every client, with no filtering on satisfaction and no reward of any kind, at most once every 90 days, and every message carries a one-click unsubscribe link.
• Where your visit came from: measuring which channels and which pages bring in enquiries, so we know where to be present and what to improve. The count stays aggregate: it is never used to profile you, to personalise what you see, or for advertising.

Legal bases

Each processing activity rests on a specific legal basis:

• Appointments, course enrolments, invoices: performance of our contract with you, and our legal obligations regarding accounting and vocational training.
• Waiting list and new-session announcements: your consent, given by entering your address in the dedicated form. You can withdraw it at any time, in one click, from any of our messages.
• Phone call-back: your consent, given separately by ticking the matching box. If you do not tick it, your number is not stored.
• Audience measurement: your consent, collected in the cookie banner and revocable at any time.
• Where your visit came from: our legitimate interest in knowing which channels and which pages bring in enquiries, without which we could not tell whether what we publish is of any use. It is recorded only together with your request, serves no other purpose, and you can object by writing to us.
• Rights-request register: our legal obligation to handle your request and to be able to demonstrate that we did (articles 12 and 5(2) of the GDPR). Without that trace, a lost request would be indistinguishable from one that was never made, to your detriment as much as ours.
• Site security: our legitimate interest in protecting the service against automated submissions, and in protecting people whose address could be entered without their agreement.
• Refill reminder after a treatment: our legitimate interest, within what the law calls soft opt-in (article L34-5 of the French postal and electronic communications code): your address was collected during a treatment, the message concerns a similar treatment only, and every send carries a one-click refusal link. You can also switch it off in your account settings.
• Review request after an appointment: our legitimate interest in collecting public feedback on a service you have just received. You can object in one click from the message, whether or not you have an account.

Data sharing

We do not sell your data and do not share it for any commercial purpose. To run the service, some data is processed by technical sub-processors acting on our behalf and contractually bound to protect it: Stripe (payments), Google (website hosting, email delivery and, with your consent, audience measurement via Google Analytics) and MongoDB Atlas (database hosting). If you take a CPF-funded certifying course, your assessment data (results, attendance sheets, assessment records) is also shared with the certifying body CO FORMATIONS (SIRET 898 885 827 00029), which is responsible for awarding the certification, to meet its monitoring and traceability obligations. Apart from these cases, we only disclose your information to other third parties where required by law or to protect our rights.

Data retention

Your personal information is retained for as long as your account exists. You can ask for it to be deleted at any time, in your account settings. That deletion does not erase everything in the same way, and the difference matters:

• Erased: your profile — first name and surname, email address, and photo where there is one — along with your message preferences, your access to the site, and the link to your Google account if there is one. Your reviews and your waiting-list signup are erased in the same way.
• Made anonymous: your past appointments. The record remains, with its date, the treatment and the amount, because our accounting has to be able to account for them; everything that names you is removed from it — the link to your account, your first name and surname, your email address and your phone number. Once that is done, nothing in that record leads back to you. The same applies to a training application that never resulted in a payment.
• Kept in your name: your invoices, and the file for the training you attended and paid for. For ten years from the close of the accounting year concerned, under article L123-22 of the French commercial code and the obligations specific to training organisations: an invoice must name its customer, and that legal obligation prevails over the right to erasure, as article 17(3)(b) of the GDPR provides. Those documents serve no other purpose.
• Language cookie: Retained for 1 year.
• Theme cookie: Stored in localStorage with no expiry.
• Audience-measurement consent choice: Stored in localStorage (with its date) until you change it.
• Session memory for where your visit came from: erased when you close the tab.
• Audience-measurement data (Google Analytics 4): Anonymised statistics retained for at most 14 months.
• Waiting list: 3 years from the last contact, in line with the CNIL's recommendation for prospect data. After that, it is deleted.
• After an unsubscribe: we keep only your email address and the fact that you no longer wish to be contacted, so that we never approach you again. Your phone number and where your visit came from, campaign parameters and landing page included, are erased immediately.
• Protection against automated submissions: a counter tied to your IP address, deleted automatically after one hour.
• Rights-request register: when you exercise one of your rights we record which one, the date it reached us and the date we answered, so that we can show we replied within the one-month deadline. Your address and your message are held only for as long as the request is open: they are erased the moment it is closed. What remains names nobody, and is deleted after a year.
• List of people who no longer wish to be contacted: kept with no time limit, since erasing it would mean approaching you again. It holds only your email address and the type of message you declined.

User rights

Access: You have the right to access the personal information we hold about you.

Modification: You can modify your first and last name in your account settings. The email address cannot be changed for security reasons.

Deletion: You can request the deletion of your account and personal data in your account settings. Your profile is then erased and your past appointments are made anonymous; only the documents the law requires us to keep, invoices included, remain in your name. The detail is in the "Data retention" section.

If you have no account, for instance if you are only on the waiting list: write to kristina@beautynform.com. We answer any request for access, rectification, erasure, restriction, portability or objection within one month.

Objecting to marketing: you may refuse our messages at any time and without giving a reason, either through the unsubscribe link in every message or by writing to us.

Complaints: if you believe your rights are not being respected, you can lodge a complaint with the CNIL, the French data protection authority, at www.cnil.fr.

Data security

We implement technical and organisational security measures to protect your personal information against loss, misuse, unauthorised access, disclosure, alteration, or destruction. Data is stored on a MongoDB Atlas cluster in Belgium and is only accessible via a secure token-based connection provided by NextAuth.

International transfers

Your data is hosted in the European Union. The only transfers outside the European Union concern our web-analytics tool (Google Analytics), enabled only with your consent: they are governed by the EU-US Data Privacy Framework, to which Google adheres.

Changes to the privacy policy

Beauty'n'Form reserves the right to modify this privacy policy at any time. We will inform you of any significant changes by publishing the new privacy policy on our website. We encourage you to check this page regularly to stay informed of any changes.

Contact

If you have any questions or concerns about this privacy policy, or if you wish to exercise your rights as a user, please contact:

• Kristina Mouyen
• President of Beauty'n'Form
• Email: kristina@beautynform.com
• Address: 875 B chemin de Pourradel, 31620 Fronton