GDPR Policy

---

1. Introduction 

Biba Aesthetics Ltd recognises the importance of protecting personal data and ensuring the privacy and rights of individuals. This policy outlines our commitment to handling personal data in compliance with the General Data Protection Regulation (GDPR) and the UK Data Protection Act. 

1. Scope 

This policy applies to all personal data processed by Biba Aesthetics Ltd, whether in electronic form, paper, or other means. 

1. Principles 
2. We commit to: 

• Processing personal data lawfully, fairly, and transparently. 
• Collecting data for specific, explicit, and legitimate purposes. 
• Ensuring that the data collected is relevant and limited to what is necessary. 
• Keeping data accurate and up-to-date. 
• Storing data no longer than necessary. 
• Processing data in a manner ensuring appropriate security. 

1. Data Collection 

We collect personal data only with explicit consent and for legitimate business purposes. When collecting data, individuals are informed of its intended use, the legal basis for processing, and their rights concerning the data. 

1. Data Access and Sharing 

Access to personal data is restricted to authorised personnel who have a legitimate business need. We do not share or sell personal data to third parties unless required by law or with explicit consent from the individual. 

1. Data Rights 
2. Individuals have the right to: 

• Access their personal data. 
• Correct inaccuracies in their data. 
• Withdraw consent. 
• Erase their data. 
• Restrict or object to data processing. 
• Data portability. 

1. Any individual wishing to exercise these rights can contact us through our contact page.
2. Data Retention 

Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of meeting legal, accounting, or reporting requirements. 

1. Data Security 

We implement appropriate technical and organisational measures to safeguard personal data against unauthorised access, alteration, disclosure, or destruction. 

1. Breach Notification 

In the event of a data breach that risks individuals' rights and freedoms, we will notify the affected individuals and the relevant regulatory body within 72 hours of becoming aware of the breach. 

1. Amendments 

This policy may be updated periodically to reflect changes in our data processing practices or for other operational, legal, or regulatory reasons. 

1. Contact 

For more information about our data protection practices or if you have any concerns or questions, please contact us through our contact page.