Privacy policy

Last updated: 1 September 2026

Who holds your information

I do. I'm Zoltan Vargyai. I work as a sole trader, trading as Zoltan Hair and Tecsture by Zoltan, from a chair I rent in a salon on Maddox Street, Mayfair, London.

I'm the data controller for everything on this page. That means it's my responsibility, not the salon's and not Squarespace's.

care@zoltan-hair.com · +44 7875 396751 (WhatsApp only). Ask me and I'll give you a postal address to write to.

I work on my own. Nobody else sees your information unless it says so below.

What I collect, and when

When you book. Your name, email, phone number, and what you're booking. Booking goes through Acuity Scheduling.

On the booking form, before I touch your hair. Your hair history — what's been done to it, when, and with what. And health information: medicines you take, conditions you have, whether you're pregnant or breastfeeding, and any allergies or past reactions.

In the chair. Notes on what I did, what I used, and how the hair behaved. I write these by hand.

Photographs and video. Before and after, and sometimes during a treatment.

Voice notes. I dictate notes to myself. I write them up and then delete the recording.

If you message me. WhatsApp messages, emails and any photos you send me.

If you join my mailing list. Your name and email.

When you visit the site. See the cookie notice.

The health questions — and why they're treated differently

Health information is what the law calls special category data. It gets stronger protection than your name and number, and rightly so.

I ask because chemical texture work is not cosmetic. Certain medicines change how hair takes a treatment. Pregnancy changes what I'm willing to do. A past reaction tells me what not to put near you. If I don't know, I'm working blind on your head.

My lawful basis for collecting it is your explicit consent — Article 9(2)(a) of the UK GDPR. I ask for it separately on the booking form, in plain words. It has to be a real choice, so here is the honest version: if you don't want to answer, tell me and we'll talk. Depending on what you're having done, I may not be able to do the treatment safely. That's the trade-off, and it's yours to make.

You can withdraw that consent at any time. One thing to know: after your appointment I keep the consultation record even if you withdraw, because I may need it to answer a complaint or defend a claim. The law allows that separately — Article 9(2)(f). I stop using it for anything else.

Photographs, video and voice notes

I photograph and film hair — before, during and after a treatment. I also dictate voice notes to myself, write them up, and delete the recording.

I use the images three ways: as my own reference so I can see next time what your hair actually did; on social media, my website and in press; and in the professional courses I teach at teCsture.

What allows me to do this is my legitimate interest in showing and teaching my work — Article 6(1)(f) of the UK GDPR. Texture work can only be judged by looking at it. It is how hairdressers learn and how clients decide.

I photograph hair, not conditions. Images that would show a scalp condition or medical hair loss don't get used. I don't publish your name with a picture unless you ask me to.

You can object. Email care@zoltan-hair.com and say so — before, during or long after your appointment. I'll stop using your images and take down what I control. Two honest limits: course material that has already been printed, sold or downloaded can't be recalled, and I can't retrieve copies other people have saved or shared. I'll stop using the image in anything new.

Why I use your information, and what allows me to

What for	What allows me to
Booking you in, doing the treatment, aftercare	Our contract — Art 6(1)(b)
Health and hair-history questions	Your explicit consent — Art 9(2)(a)
Keeping consultation records after your visit	My legitimate interest in safe practice and continuity — Art 6(1)(f); and for legal claims — Art 9(2)(f)
Photographs and video	My legitimate interest in showing and teaching my work — Art 6(1)(f)
Marketing emails	Your consent — Art 6(1)(a)
Tax and accounting records	Legal obligation — Art 6(1)(c)
Answering a complaint or defending a claim	Legitimate interest — Art 6(1)(f); Art 9(2)(f)

Who else touches your information

I don't sell your data. I've never sold anyone's data and I'm not going to start. Nobody gets it for their own purposes.

These companies process it on my instructions, to run things I can't run myself:

Acuity Scheduling (Squarespace) — bookings, reminders, the intake form and your answers on it
Squarespace — this website, and Email Campaigns for my mailing list
Google Workspace — my email and files
Google Analytics — visitor statistics, only if you accept analytics cookies
Weglot — translates the site into other languages
WhatsApp (Meta) — if you message me there

Some of these are outside the UK, mainly in the United States. Where that happens, transfers rely on the safeguards UK law requires for international transfers, under each provider's own data processing terms.

CCTV: there are cameras in the salon. They are not mine — they belong to the salon owner, who is responsible for them. If you want footage, ask me and I'll point you to the right person.

I'll also hand over information if the law requires it. If that ever happens I'll tell you, unless I'm not allowed to.

How long I keep things

Consultation notes, health answers, treatment records and photographs — 7 years after your last appointment. That covers the time limits for bringing a claim: three years for personal injury and six for contract, under the Limitation Act 1980.
Money records — 5 years after the 31 January filing deadline for the relevant tax year, which is what HMRC requires of the self-employed.
Voice notes — deleted once written up.
Mailing list — until you unsubscribe.
WhatsApp and email threads — cleared out with the rest at 7 years.

Then it's deleted, or the paper is destroyed.

Marketing

I only email you if you asked me to. Every email has an unsubscribe link and it works immediately. I don't pass your address to anyone else.

Appointment confirmations and reminders aren't marketing — you get those because you booked.

Your rights

You can ask me to:

show you what I hold about you
correct anything wrong
delete it
stop or limit what I do with it
send it to you or someone else in a portable form
stop relying on legitimate interests
withdraw consent you've given

It's free and I'll answer within one month. Just email care@zoltan-hair.com.

Two honest limits: I can't delete records I'm legally required to keep for tax, and I may keep a consultation record for the seven years above where I need it to defend a claim. I'll tell you plainly if either applies.

If you're unhappy with how I've handled your information

Tell me first — care@zoltan-hair.com — and I'll try to put it right.

If that doesn't satisfy you, you can complain to the Information Commissioner's Office. ico.org.uk · 0303 123 1113. You don't need my permission and it doesn't cost you anything.

Changes

I update this when something changes. The date at the top tells you when I last did.