Legal
Privacy Policy
Last updated 24 September 2026
This privacy notice explains how AndySullsHair Barbershop & Academy ("AndySullsHair", "we", "us", "our") collects, uses, shares and protects personal data, and the rights you have in relation to it. It applies to our website, our barbershops in Cork City and Glanmire, our booking service, and the AndySullsHair Academy.
We process personal data in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR"), the Data Protection Act 2018, and the European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011 (S.I. No. 336 of 2011, the "ePrivacy Regulations").
1. Data controller
The data controller is AndySullsHair Barbershop & Academy, trading from Unit 1, Lancaster Quay, Mardyke, Cork, T12 P218, Ireland, and Unit 5, Glanmire Industrial Estate, Riverstown, Sallybrook, Glanmire, T45 VW52, Ireland.
Contact for data protection matters: andysullshair@gmail.com, or 085 836 5644, or by post to Unit 1, Lancaster Quay, Mardyke, Cork, T12 P218. We are not required to appoint a Data Protection Officer under Article 37 GDPR and have not done so.
2. The personal data we collect
- Identity and contact data: name, email address, phone number, and, for Academy students, date of birth.
- Booking data: appointments booked, services chosen, barber preference, attendance and cancellation history, and notes needed to provide your service.
- Payment data: payment amounts and dates. Card details are collected and processed by Squire and its payment provider; we do not store full card numbers.
- Academy data: the course you are interested in, your message, conversation history (email, phone, WhatsApp), enrolment details, attendance, progress notes and certificate details.
- Marketing data: your preferences for receiving marketing from us, and records of consent or opt-out.
- Technical and usage data: IP address, browser type and version, device identifiers, operating system, referring pages, pages viewed and interactions, collected through server logs and, with your consent, cookies and similar technologies.
- Correspondence: the content of messages you send us through the website, email, phone, social media or WhatsApp.
We do not intentionally collect special category data (such as health data). If you tell us something we need to know to cut your hair safely, for example a scalp condition or an allergy, we process it on the basis of your explicit consent (Art. 9(2)(a)) and keep it only as long as needed.
3. Where the data comes from
Most personal data comes directly from you: when you book through Squire or our app, fill in a form on this website, message us on WhatsApp, email or call us, or attend the shop or the Academy. We also receive technical data automatically from your browser or device, and booking data from Squire when you book through its platform.
4. Purposes and legal bases
Article 6 GDPR requires a lawful basis for each purpose. The table below sets out what we do with your data and why we are allowed to.
| Purpose | Data used | Legal basis |
|---|---|---|
| Taking and managing appointment bookings, sending reminders, processing payments and handling cancellations | Identity and contact data, booking history, payment data (handled by Squire) | Performance of a contract with you (Art. 6(1)(b)) |
| Answering enquiries about the Academy and following up about the course you asked about, by email, phone or WhatsApp | Identity and contact data, course interest, message content, conversation history | Steps at your request before entering a contract (Art. 6(1)(b)); our legitimate interest in responding to and following up on enquiries we receive (Art. 6(1)(f)) |
| Enrolling and teaching Academy students, issuing certificates of completion and supporting job placement | Identity and contact data, date of birth (to confirm you are 16 or over), attendance and progress notes, certificate details | Performance of a contract (Art. 6(1)(b)); legitimate interest in supporting graduates into work, where you ask us to (Art. 6(1)(f)) |
| Replying to messages sent through the contact form, email, phone or social media | Identity and contact data, message content | Legitimate interest in responding to people who contact us (Art. 6(1)(f)) |
| Sending marketing messages about our services and courses | Contact data, marketing preferences | Consent (Art. 6(1)(a)), which you can withdraw at any time; or, for existing clients and similar services, our legitimate interest under the soft opt-in rules in Regulation 13 of S.I. 336/2011, always with an easy way to opt out |
| Keeping the website secure, preventing fraud and abuse, and diagnosing faults | Technical data (IP address, browser, device and request logs) | Legitimate interest in the security and integrity of our website (Art. 6(1)(f)) |
| Measuring how the website is used and the performance of our advertising | Technical and usage data, cookie identifiers, advertising identifiers | Consent (Art. 6(1)(a)) given through the cookie banner; storage of and access to cookies under Regulation 5 of S.I. 336/2011 |
| Keeping accounting, tax and other statutory records | Booking, invoice and payment records | Legal obligation (Art. 6(1)(c)), including the Taxes Consolidation Act 1997 and the Companies Act 2014 |
| Establishing, exercising or defending legal claims, and handling complaints | Any of the above as relevant | Legitimate interest in protecting our legal position (Art. 6(1)(f)); Art. 9(2)(f) where special category data is involved |
Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms and concluded that they are not overridden. You can ask us for a summary of that assessment, and you can object to processing based on legitimate interests at any time (see section 10).
Providing your data is voluntary, but we cannot take a booking, enrol you, or answer an enquiry without the details needed to do so.
5. Who we share your data with
We do not sell personal data, and we do not share it with third parties for their own marketing. We use the following processors, each bound by a written contract meeting Article 28 GDPR that limits them to acting on our instructions:
| Provider | What they do for us | Where data is processed |
|---|---|---|
| Squire Technologies, Inc. | Online booking, point of sale, payments and appointment reminders | United States |
| HighLevel Inc. (GoHighLevel) | Customer relationship management for Academy enquiries: form submissions, email, SMS and WhatsApp conversations, automated follow-ups | United States |
| Cloudflare, Inc. | Website hosting, content delivery and security | EU and United States (global network) |
| Google Ireland Limited | Google Tag Manager and Google Analytics (only with your consent); Google Workspace email | Ireland; may transfer to the United States |
| Meta Platforms Ireland Limited | Facebook and Instagram advertising measurement (only with your consent); WhatsApp Business messaging when you message us on WhatsApp | Ireland; may transfer to the United States |
| TikTok Technology Limited | Advertising measurement (only with your consent) | Ireland; may transfer to the United States and other countries |
| Elfsight Group | Displaying our Google reviews on the website (only with your consent) | European Economic Area |
| FormSubmit | Relaying general contact form messages to our email | United States |
Some of these providers also act as independent controllers of certain data. When you message us on WhatsApp, Meta processes your account and message metadata under its own privacy policy. When you book through Squire, Squire processes your account under its own policy. Google, Meta and TikTok act as independent controllers for the advertising and analytics data they collect once you have consented to those cookies.
We may also share data with our accountants and professional advisers, with banks and payment providers, with insurers in the event of a claim, and with An Garda Síochána, the Revenue Commissioners, courts or regulators where the law requires or permits it.
6. International transfers
Several of our providers process data outside the European Economic Area, mainly in the United States. Where that happens, we rely on one of the safeguards in Chapter V GDPR: an adequacy decision of the European Commission (including the EU-US Data Privacy Framework, where the provider participates in it), or the European Commission's Standard Contractual Clauses together with any supplementary measures needed. You can ask us for details of the safeguard used for a particular provider.
7. How long we keep your data
| Data | Retention period | Reason |
|---|---|---|
| Appointment, client and payment records | 6 years from the end of the year of the transaction | Revenue and Companies Act record-keeping obligations |
| Academy enrolment records, attendance and certificates | 6 years after the course ends | Contractual and statutory records; reissuing certificates on request |
| Academy enquiries that do not lead to enrolment, including WhatsApp and email conversations | 24 months from our last contact with you, or sooner if you ask | Reasonable period to follow up on an expressed interest |
| General contact form messages and emails | 12 months after the query is closed | Handling any follow-up |
| Marketing consent and preferences | Until you withdraw consent or opt out, plus a suppression record so we do not contact you again | Honouring your choice |
| Website analytics data | 26 months | Google Analytics default retention |
| Security and access logs | Up to 12 months | Investigating security incidents |
| Your cookie choice | 12 months, in your browser | Remembering your preference |
When a retention period ends we delete or anonymise the data. Where data is needed for an ongoing complaint or legal claim, we keep it until the matter is closed.
8. Cookies and similar technologies
Under Regulation 5 of the ePrivacy Regulations, we may only store or access cookies on your device with your consent, unless a cookie is strictly necessary to provide a service you have asked for. When you first visit this website, a banner lets you accept all cookies, reject all non-essential cookies, or choose by category. Nothing non-essential loads until you make a choice. You can change or withdraw your choice at any time through the Cookie settings link in the footer, and withdrawing is as easy as giving consent.
- Strictly necessary: one first-party setting that records your cookie choice. It contains no personal data and expires after 12 months.
- Analytics (consent): Google Analytics, loaded through Google Tag Manager, to measure how the site is used. IP addresses are truncated. Cookies last up to 2 years.
- Marketing (consent): Meta Pixel and TikTok Pixel, loaded through Google Tag Manager, to measure our advertising and show you relevant ads on those platforms. Cookies last up to 13 months.
- Embedded content (consent): the Google reviews widget provided by Elfsight sets its own cookies when loaded. If you have not consented, we show a link to our reviews on Google instead.
You can also block or delete cookies through your browser settings, though some features may then not work.
9. Direct marketing
We send marketing by email, SMS or WhatsApp only where you have consented, or where you are an existing client and we are telling you about similar services, in which case you were given the chance to opt out when we collected your details and in every message since (Regulation 13, ePrivacy Regulations). Every marketing message includes an unsubscribe option, and you can opt out at any time by emailing andysullshair@gmail.com. We keep a suppression record so that we do not contact you again.
10. Your rights
Under Articles 15 to 22 GDPR you have the right to:
- Access the personal data we hold about you and receive a copy, with the information in this notice;
- Rectification of inaccurate or incomplete data;
- Erasure ("right to be forgotten") where the data is no longer needed, you withdraw consent, you object and there is no overriding ground, or the processing is unlawful;
- Restriction of processing while a dispute about accuracy or lawfulness is resolved;
- Data portability: a copy of data you provided to us, in a structured, commonly used, machine-readable format, where we process it by automated means on the basis of consent or contract;
- Object at any time to processing based on legitimate interests, and to direct marketing, which we will stop immediately;
- Withdraw consent at any time where consent is the legal basis, without affecting processing carried out before withdrawal;
- Not be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects. We do not make such decisions.
To exercise a right, email andysullshair@gmail.com or write to us at the address in section 1. We may need to confirm your identity first. We will respond without undue delay and within one month; if a request is complex we may extend this by up to two further months and will tell you why. Requests are free unless they are manifestly unfounded or excessive.
You also have the right to lodge a complaint with the supervisory authority: the Data Protection Commission, 6 Pembroke Row, Dublin 2, D02 X963, Ireland; www.dataprotection.ie; phone 01 765 0100 or 1800 437 737. We would appreciate the chance to resolve any concern first, but you may contact the Commission at any time.
11. Security
In line with Article 32 GDPR we apply technical and organisational measures appropriate to the risk, including encryption of data in transit (TLS), access controls so that only staff who need your data can see it, secure and reputable providers, and confidentiality obligations on our team. No system is completely secure; if a personal data breach is likely to result in a risk to your rights and freedoms we will notify the Data Protection Commission within 72 hours of becoming aware of it and, where the risk is high, tell you without undue delay.
12. Children
Our website and marketing are not directed at children under 16, and Academy students must be 16 or over. We do not knowingly collect personal data from children under 16 without the consent of a parent or guardian. Barbershop appointments for children are booked by, and held in the name of, a parent or guardian. If you believe we hold data about a child without appropriate consent, contact us and we will delete it.
13. Links to other websites
This website links to third-party sites and services, including Squire, WhatsApp, Instagram, TikTok, Facebook, the Apple App Store and Google Play. Those sites have their own privacy notices and we are not responsible for how they use your data.
14. Changes to this notice
We review this notice at least annually and whenever our processing changes. The current version, with the date it took effect, is always published on this page. Where a change materially affects you we will take reasonable steps to bring it to your attention.
This notice replaces the privacy policy dated 14 July 2025.