Privacy Policy

Effective Date: 18-Jun-2026

1. Introduction & Legal Framework

Welcome to Lorna Bowes' website. Lorna Bowes ("we", "us", or "our") acts as the Data Controller. We are committed to protecting and respecting your privacy in strict compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Data (Use and Access) Act 2025 (collectively, "the Data Protection Legislation").

2. Information We Collect

We may collect and process the following data about you:

• Identity Data: Name, provided when using our contact form.
• Contact Data: Email address and phone number.
• Technical Data: Internet protocol (IP) address, browser type, and version via cookies.

3. Lawful Basis for Processing

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

• Consent: Where you have given explicit permission.
• Legitimate Interests: Where it is necessary for our legitimate business interests (e.g., replying to your business inquiries submitted via our contact form).
• Cookie Exemptions: In accordance with the Data (Use and Access) Act 2025, low-risk statistical and analytics cookies may be utilized to monitor website performance without requiring explicit prior consent, though you maintain the right to opt out via your browser settings.

4. Data Retention

We will only retain your personal data for as long as reasonably necessary to fulfill the purposes we collected it for. To comply with UK HMRC tax and corporate accounting audit requirements, any documents containing commercial or financial transaction data will be strictly retained for 6 years following the end of the financial year to which they relate.

5. Your Statutory Rights (Subject Access Requests)

Under data protection laws, you have comprehensive rights regarding your personal data, including:

• Your right of access: You have the right to ask us for copies of your personal information.
• Your right to rectification: You have the right to ask us to rectify personal information you think is inaccurate.
• Your right to erasure: You have the right to ask us to erase your personal information in certain circumstances.
• Your right to restriction of processing: You have the right to ask us to restrict the processing of your personal information in certain circumstances.

To exercise any of these rights, or to submit a formal "Subject Access Request" (SAR) for a copy of your records, please contact us. We will conduct a reasonable search and respond without undue delay, strictly within one calendar month of receipt.
Note: In accordance with the Data (Use and Access) Act 2025, if your request is broad or requires further clarification, the statutory one-month clock will be paused until we receive the necessary details from you.

6. Mandatory Data Queries & Complaints Procedure

We take all data privacy queries seriously. In accordance with the statutory obligations introduced under the Data (Use and Access) Act 2025, you have a formal right to lodge a complaint regarding how your data is handled.

Under UK law, you are required to submit any data protection complaints directly to us in the first instance to allow for an internal investigation.

• How to Complain: If you have any questions, concerns, or complaints about how we collect, store, or use your personal data, please contact us directly at: info@aestheticsource.com.
• Our Obligations: We will formally acknowledge receipt of your data complaint within 30 days of submission, investigate it without undue delay, and provide you with a resolution outcome.

If you are not satisfied with our response following our internal review, you retain the legal right to escalate your complaint to the Information Commissioner's Office (ICO) at www.ico.org.uk.