Privacy Policy
Last updated: 31.08.2026
This Privacy Policy explains how Izzyskin collects, uses, stores and protects your personal data when you visit www.izzy-skin.com, book or receive a treatment, buy a product from us, or contact us.
We take your privacy seriously, and we are particularly careful with the health related information you share with us before a treatment.
1. Who we are
Izzyskin is the data controller responsible for your personal data.
Business name: Izzy Skin EE 59290 / Tax Identification Number: 08088725C Address: Villa Izmel, 73 Theodorou Kolokotroni, 8560 Peyia, Paphos, Cyprus Email: izzyskinbeauty@gmail.com Phone: +357 96448959
If you have any questions about this policy or about how we handle your data, contact us using the details above.
2. What personal data we collect
Depending on how you interact with us, we may collect:
Identity and contact data Your name, surname, email address, telephone number, and, where relevant, your postal address.
Appointment data The date and time of your appointment, the treatments booked, your treatment history with us, appointment notes, cancellations and no shows.
Health and skin data (special category data) Information you provide on our consultation form or verbally before treatment, such as skin type and skin concerns, allergies and sensitivities, patch test results, medical conditions, medications, recent cosmetic or medical procedures, pregnancy or breastfeeding status, and contraindications relevant to the treatment.
We only collect this information because it is necessary for your safety and for the treatment to be carried out correctly.
Images Before and after photographs of the treated area, where you have agreed to them being taken.
Purchase and payment data Products or treatments purchased, order history, delivery details, invoices, and partial payment card information. We do not store your full card number. Card payments are processed by our payment provider.
Communications The content of emails, text messages, WhatsApp messages, social media messages and phone enquiries you send us, along with our replies.
Marketing preferences Whether you have consented to receive our newsletter or promotional messages, and whether you have withdrawn that consent.
Reviews and testimonials Feedback you submit, and your name or initials where you have agreed to us publishing it.
Technical and website data IP address, browser type and version, device type, operating system, pages visited, time spent on the site, referring website, and information collected through cookies and similar technologies.
3. Why we use your data and our legal basis
Under the General Data Protection Regulation (EU) 2016/679 we must have a legal basis for every use of your data.
What we do
Why
Legal basis
Book, confirm, reschedule and remind you of appointments
To provide the service you asked for
Performance of a contract
Sell and deliver skincare products, process payments and handle returns
To complete your order
Performance of a contract
Assess whether a treatment is safe and suitable for you, record consultation and patch test results
Your safety and the correct delivery of the treatment
Explicit consent, Article 9(2)(a) GDPR
Take before and after photographs
Recording treatment progress, and marketing where separately agreed
Consent, and explicit consent for health related images
Issue invoices and keep accounting records
Legal obligation under Cypriot tax and accounting law
Legal obligation
Answer your enquiries
To respond to you
Legitimate interests
Send you our newsletter and offers
To keep you informed about our services
Consent, or legitimate interests for existing clients regarding similar services
Keep records to defend ourselves against a complaint or claim
Protecting our legal position
Legitimate interests, and Article 9(2)(f) GDPR where health data is involved
Improve and secure our website, measure traffic
Running the site properly
Legitimate interests, and consent for non essential cookies
You can withdraw consent at any time. Withdrawing consent does not affect the lawfulness of anything we did before you withdrew it. Please note that if you withdraw consent for us to process your health information, we may not be able to carry out certain treatments safely, and we may have to decline them.
4. Who we share your data with
We never sell your personal data. We share it only where it is necessary, and only with:
Squarespace, which hosts our website and processes online orders
Our payment provider, PAYPAL / OTHER, which processes card payments
Our accountant and tax advisers, for invoicing and statutory reporting
Delivery and courier companies, where a product is being shipped to you
Our insurers and legal advisers, if a complaint or claim is made
Public authorities, where we are legally required to disclose information
All of these parties are bound by contract or by law to keep your data confidential and to use it only for the purpose we specify.
Please note: our studio is located inside the Woodward & Marescu Hair Salon. Izzyskin operates as a separate business and does not share client records with the salon.
5. Transfers outside the European Economic Area
Some of our service providers, including Squarespace, are based in the United States or store data outside the EEA. Where data is transferred outside the EEA, we rely on the European Commission's Standard Contractual Clauses, or on an adequacy decision such as the EU–US Data Privacy Framework, to ensure your data receives an equivalent level of protection.
You can request a copy of the relevant safeguards by contacting us.
6. How long we keep your data
Type of record
Retention period
Consultation forms, treatment records, patch test records
[6] years after your last treatment, so that we can respond to any complaint or claim within the limitation period
Appointment history
[3] years after your last appointment
Invoices, orders and accounting records
6 years, as required by Cypriot tax legislation
Before and after photographs
Until you withdraw consent, or [3] years after your last treatment, whichever is earlier
Marketing contacts
Until you unsubscribe, or after [24] months of inactivity
Enquiries that did not lead to a booking
[12] months
Website analytics data
As set by the relevant provider, typically up to 26 months
When a retention period ends, we delete the data or anonymise it so that it can no longer be linked to you.
7. Your rights
Under the GDPR you have the right to:
Access your personal data and receive a copy of it
Rectification of inaccurate or incomplete data
Erasure of your data, where there is no ongoing legal reason for us to keep it
Restriction of processing in certain circumstances
Data portability, receiving your data in a structured, machine readable format
Object to processing based on our legitimate interests, and to object to direct marketing at any time
Withdraw consent at any time where processing is based on consent
Not be subject to decisions based solely on automated processing. We do not carry out automated decision making or profiling.
To exercise any of these rights, email izzyskinbeauty@gmail.com. We will respond within one month. We may ask you to confirm your identity before we act on the request.
If you are not satisfied with our response, you have the right to lodge a complaint with the supervisory authority:
Office of the Commissioner for Personal Data Protection Iasonos 1, 1082 Nicosia, Cyprus Telephone: +357 22818456 Email: commissioner@dataprotection.gov.cy Website: www.dataprotection.gov.cy
8. Cookies
Our website uses cookies and similar technologies.
Essential cookies are necessary for the site to function, for example to keep items in your shopping cart and to keep your session secure. These do not require your consent.
Analytics and performance cookies help us understand how visitors use the site so that we can improve it.
Marketing cookies may be used to show you relevant advertising on other platforms, including Facebook and Instagram.
We only place non essential cookies with your consent, which you give through the cookie banner when you first visit the site. You can change or withdraw your preferences at any time through the cookie settings on our site, or by clearing cookies in your browser.
9. Marketing
If you subscribe to our newsletter, or if you are an existing client, we may send you information about treatments, products and offers.
Every marketing message includes an unsubscribe link. You can also ask us to stop at any time by emailing izzyskinbeauty@gmail.com or by replying to any message. We will action the request without delay.
Unsubscribing from marketing does not stop appointment confirmations, reminders or order updates, which are part of the service you have booked.
10. Social media
We maintain pages on Facebook and Instagram. If you interact with us there, for example by sending a message, commenting or tagging us, those platforms process your data under their own privacy policies, which we do not control.
We will never publish a photograph of you, or a testimonial that identifies you, without your prior consent.
11. Minors
Our website and our online store are not directed at children. In line with Cypriot law, we do not knowingly collect personal data from anyone under 14 years of age through our website without parental consent.
Treatments for clients under 18 are provided only with the consent of a parent or legal guardian, who must complete and sign the consultation form.
12. How we protect your data
We take appropriate technical and organisational measures to protect your data, including:
Storing paper consultation forms in a locked cabinet accessible only to authorised staff
Password protected devices and accounts, with two factor authentication where available
Encrypted connections on our website (SSL)
Limiting access to client records to those who need it to do their job
Regular review of the service providers we work with
No system is completely secure. If a data breach occurs that is likely to result in a high risk to your rights, we will notify you and the Commissioner as required by law.
13. Changes to this policy
We may update this Privacy Policy from time to time, for example if our services or our service providers change, or if the law changes. The current version is always published on this page, with the date of the last update at the top.
If we make a significant change, we will notify you by email or through a notice on the website.
14. Contact
Izzyskin Inside the Woodward & Marescu Hair Salon, Shop 2 Aristo Village Complex 13, Coral Bay Avenue, Peyia 8575, Cyprus Email: izzyskinbeauty@gmail.com Phone: +357 96448959