Privacy policy

Last updated: 4 October 2026

Who holds your information

I do. I'm Zoltan Vargyai. I work as a sole trader, trading as Zoltan Hair and Tecsture by Zoltan, from a chair I rent in a salon on Maddox Street, Mayfair, London.

I'm the data controller for everything on this page. That means it's my responsibility, not the salon's and not any of the companies listed below.

care@zoltan-hair.com. Ask me and I'll give you a postal address to write to.

I work on my own. Nobody else sees your information unless it says so below.

What I collect, and when

When you book. Your name, email, mobile number, what you'd like me to call you, and what you're booking. Your card details go straight to the payment provider; I only ever see the card type, the last four digits and the expiry. Bookings go through my own booking system on this site (and through my previous booking system for appointments booked there before the switch).

On the booking form, before I touch your hair. Your hair history — what's been done to it, when, and with what. And health information: medicines you take, conditions you have, whether you're pregnant or breastfeeding, and any allergies or past reactions.

In the chair. Notes on what I did, what I used, and how the hair behaved. I write these by hand.

Photographs and video. Before and after, and sometimes during a treatment.

Voice notes. I dictate notes to myself. I write them up and then delete the recording.

If you message me. WhatsApp messages, emails and any photos you send me.

If you join my mailing list. Your email (and name, if you give it), when you said yes, and how: the box at booking or the sign-up on the site.

When you visit the site. See the cookie notice.

Booking steps. To see where booking gets difficult, the booking page counts which step was reached (opened the page, treatment, times, details, card) under a random number that lives only in the open page: no cookie, no name, no contact details, no IP address. These counts are deleted after 90 days.

Error logs. When something on this site or the booking system goes wrong, I keep a short note so I can fix it: the time, the page and step, the type of device (for example “iPhone · Safari”), a reference number and, if you have one, your appointment number. It never includes your name, contact details, health answers, photos, card details or anything you typed, and it uses no cookie. Your IP address is not kept: a scrambled form of it is held for one hour only, to stop floods of reports. The notes are stored by my website hosting provider and deleted after 30 days.

The health questions — and why they're treated differently

Health information is what the law calls special category data. It gets stronger protection than your name and number, and rightly so.

I ask because chemical texture work is not cosmetic. Certain medicines change how hair takes a treatment. Pregnancy changes what I'm willing to do. A past reaction tells me what not to put near you. If I don't know, I'm working blind on your head.

My lawful basis for collecting it is your explicit consent — Article 9(2)(a) of the UK GDPR. I ask for it separately, in plain words. Health questions are optional. Answering helps me keep your hair safe; if you'd rather not, I'll ask you in person before we start.

Photographs, video and voice notes

I photograph and film hair — before, during and after a treatment. I also dictate voice notes to myself, write them up, and delete the recording.

I use the images three ways: as my own reference so I can see next time what your hair actually did; on social media, my website and in press; and in the professional courses I teach at tecSture.

What allows me to do this is my legitimate interest in showing and teaching my work — Article 6(1)(f) of the UK GDPR. Texture work can only be judged by looking at it. It is how hairdressers learn and how clients decide.

I photograph hair, not conditions. Images that would show a scalp condition or medical hair loss don't get used. I don't publish your name with a picture unless you ask me to.

You can object. Email care@zoltan-hair.com and say so — before, during or long after your appointment. I'll stop using your images and take down what I control. Two honest limits: course material that has already been printed, sold or downloaded can't be recalled, and I can't retrieve copies other people have saved or shared. I'll stop using the image in anything new.

Why I use your information, and what allows me to

What for	What allows me to
Booking you in, doing the treatment, aftercare	Our contract — Art 6(1)(b)
Health and hair-history questions	Your explicit consent — Art 9(2)(a)
Keeping consultation records after your visit	My legitimate interest in safe practice and continuity — Art 6(1)(f); and for legal claims — Art 9(2)(f)
Photographs and video	My legitimate interest in showing and teaching my work — Art 6(1)(f)
Marketing emails	Your consent — Art 6(1)(a)
Tax and accounting records	Legal obligation — Art 6(1)(c)
Answering a complaint or defending a claim	Legitimate interest — Art 6(1)(f); Art 9(2)(f)

Who else touches your information

I don't sell your data. I've never sold anyone's data and I'm not going to start. Nobody gets it for their own purposes.

These kinds of service provider process it on my instructions, to run things I can't run myself:

• Website and booking hosting — this website and my booking system: the booking records, photos you send, and the emails the site sends
• Cloud storage — encrypted backups of the booking records
• Card payments — payments and the card saved with your booking (the payment provider holds the card number; I never see it)
• Text messages — your login code, confirmations and reminders
• Email, files and calendar — my business email and my appointment calendar
• Website statistics — only if you accept analytics cookies
• My previous booking system — appointments booked there before I moved bookings to this site, until the move is complete
• Messaging apps — if you message me there
• Video and social media players — only when you press play or load a post (see the cookie notice)

Your data may be stored or processed outside the UK. Where it is, it is protected by appropriate safeguards, as UK data protection law requires for international transfers.

CCTV: there are cameras in the salon. They are not mine — they belong to the salon owner, who is responsible for them. If you want footage, ask me and I'll point you to the right person.

I'll also hand over information if the law requires it. If that ever happens I'll tell you, unless I'm not allowed to.

How long I keep things

• Health answers, hair history, consultation notes and consultation photographs — 3 years after your last treatment (if you never had one, 3 years after your last booking), then deleted or anonymised. Three years is the time limit for a personal injury claim under the Limitation Act 1980.
• Booking and treatment records (what was done, when, and what it cost) — 6 years after your last appointment, the time limit for a contract claim.
• Money records — 5 years after the 31 January filing deadline for the relevant tax year, which is what HMRC requires of the self-employed.
• Voice notes — deleted once written up.
• Mailing list — until you unsubscribe.
• Saved cards — kept by the payment provider until you ask me to remove them, or 6 years after your last appointment.
• WhatsApp and email threads — cleared out with the rest at 6 years.

Then it's deleted, or the paper is destroyed.

Backups. So nothing is lost if something breaks, encrypted backups of the booking records are kept with my cloud storage providers. They are encrypted and the key is kept separately, so the stored files can’t be read without it. Health information leaves the backups within 30 days of being deleted here. Old backups are deleted automatically: daily ones after 30 days, monthly ones after a year, and the yearly one after 6 years, so a deleted record doesn’t linger in a backup longer than that.

Marketing

I only send news if you asked me to: the box at booking is optional and never ticked for you. Every news email has an unsubscribe link and it works immediately, with one click. I don't pass your address to anyone else.

Appointment confirmations and reminders aren't marketing — you get those because you booked.

Your rights

You can ask me to:

• show you what I hold about you
• correct anything wrong
• delete it
• stop or limit what I do with it
• send it to you or someone else in a portable form
• stop relying on legitimate interests
• withdraw consent you've given

It's free and I'll answer within one month. Just email care@zoltan-hair.com.

Two honest limits: I can't delete records I'm legally required to keep for tax, and I may keep a consultation record for the six years above where I need it to defend a claim. I'll tell you plainly if either applies.

If you're unhappy with how I've handled your information

Tell me first — care@zoltan-hair.com — and I'll try to put it right.

If that doesn't satisfy you, you can complain to the Information Commissioner's Office. ico.org.uk. You don't need my permission and it doesn't cost you anything.

Changes

I update this when something changes. The date at the top tells you when I last did.

See also: Terms of use · Cookies