Privacy Policy

1. Who We Are

Bibi Saira Mehndi is a sole-trader mehndi and henna art business based in Hampshire, UK. When this policy refers to "we", "us" or "our", it means Bibi Saira Mehndi.

For any privacy enquiry please contact us at our contact page.

---

2. What Data We Collect

Booking & enquiry forms

When you submit a booking or contact form we collect your name, email address, phone number, event details and any message you provide. This information is used solely to respond to your enquiry and fulfil your booking.

Visitor analytics (cookies)

If you arrive via a search engine, social media link, or a tracked campaign URL, and you accept our cookie banner, we record:

• A randomly generated visitor identifier (stored in a bs_vid cookie, valid for 1 year)
• Pages visited, time on page, and scroll depth
• Referring source (e.g. Google, Instagram)
• UTM campaign parameters if present in the URL
• Device type, browser, operating system and screen resolution
• Approximate timezone and language settings
• IP address (used to prevent spam; not shared)

We do not use Google Analytics or any third-party analytics service. All data is stored on our own server and is not sold or shared with any third party.

Consent cookie

We store a bs_consent cookie (value 1 or 0) to remember your cookie preference for 1 year.

---

3. Legal Basis for Processing

• Bookings & enquiries — performance of a contract / taking steps to enter a contract (UK GDPR Art. 6(1)(b)).
• Analytics cookies — your consent (UK GDPR Art. 6(1)(a)). You can withdraw consent at any time by clearing the bs_consent and bs_vid cookies from your browser.

---

4. How Long We Keep Your Data

• Booking records — retained for up to 3 years for business and tax purposes, then deleted.
• Enquiries — retained for 12 months, then deleted.
• Visitor analytics — retained for 12 months, then automatically purged.

---

5. Your Rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request erasure of your data ("right to be forgotten")
• Restrict or object to processing
• Data portability
• Withdraw consent at any time (for analytics cookies)

To exercise any right, please contact us via our contact page. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

---

6. Third-Party Services

We use the following third-party services which may process data in accordance with their own privacy policies:

• WhatsApp — if you contact us via WhatsApp, Meta's privacy policy applies.
• Stripe — if an invoice is issued, Stripe processes payment details. See Stripe's privacy policy.
• Google Fonts / Bootstrap CDN — loaded from third-party CDNs; your IP may be logged by those services.

---

7. Cookies Summary

---

8. Changes to This Policy

We may update this policy from time to time. The "last updated" date at the top of this page will always reflect the most recent version.