DryBy Privacy Policy

Last updated 28 October 2026

DRYBY LTD, trading as DryBy (“we”, “us” or “our”), respects your privacy and is committed to protecting your
personal data. This policy explains how we handle personal data in connection with our website, nail services
and customer enquiries, whether you interact with us in person, online or through other communication
channels.
We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data
Protection Act 2018 and other applicable data protection legislation, as amended.

1 Who we are and how to contact us
DRYBY LTD is registered in England and Wales under company number 08800362. Our registered office is 124
City Road, London EC1V 2NX. For privacy enquiries, complaints or requests concerning your personal data,
contact studio@dryby.co.uk or write to our registered office.
DryBy provides nail services within Hershesons at Belgravia and Fitzrovia. We are a controller of personal data
where we determine why and how it is used. Bookings, payments and associated customer records are
managed through Hershesons, which also has its own data protection responsibilities and privacy notice. This
policy covers personal data processed by DryBy; it does not replace the privacy information provided by
Hershesons or other organisations acting independently.

2 Personal data we may process
Personal data means information relating to an identifiable individual. Depending on your interaction with us,
we may receive or access:
 Identity and contact information: your name and contact details, used to identify you and respond to you.
 Appointment and service information: details of appointments, treatments, relevant service history and
requirements, and transaction or refund information available to us in connection with your service.
 Correspondence and customer care information: information you supply in enquiries, feedback or
complaints and records of any response or resolution.
 Health and suitability information: relevant allergies, sensitivities or conditions where necessary to assess
treatment suitability or address a concern. This is special category data and receives additional protection.
 Technical information and preferences: information generated through use of our website, where
collected, and your communication or consent preferences.
Information may be obtained directly from you, from a person acting on your behalf, from Hershesons or
providers supporting the relevant service, or through your use of our website. We process only information
relevant to the purpose concerned. If information necessary to arrange or safely deliver a service is not
provided, we may be unable to proceed; we will explain this where applicable.

3 Why we use personal data
We use personal data only where we have an applicable lawful basis:
Providing requested services: to respond to booking-related enquiries and deliver or support your
treatment. We rely on performance of a contract with you, or steps you request before entering into one,

2
where applicable; otherwise we rely on our legitimate interests in delivering the services you have
requested.
 Customer care and business administration: to answer enquiries, resolve complaints and maintain
appropriate records. We rely on our legitimate interests in running our business and providing effective
customer care, subject to your rights and interests.
 Legal and insurance matters: to meet legal obligations or establish, exercise or defend legal claims. We
rely on compliance with a legal obligation where one applies, or our legitimate interests in resolving
disputes and protecting our legal rights.
 Website operation and security: to maintain a functioning, secure website, based on our legitimate
interests in providing and protecting it. Consent is obtained separately for cookies or similar technologies
where required.
 Optional communications: where we send promotional communications, we obtain consent where
required and provide a way to opt out. You may object to direct marketing at any time.
Where we rely on legitimate interests, we consider whether the processing is necessary and whether your
rights and interests override ours. Where we rely on consent, you may withdraw it at any time without
affecting earlier lawful processing. Use of our services or website does not itself constitute consent to
processing that requires consent.
Health information is processed only where an additional legal condition applies, such as explicit consent for
relevant treatment suitability information or necessity for establishing, exercising or defending legal claims.
Where consent is required, it must be obtained before the relevant use. You may withdraw it, although this
may affect whether a particular treatment can safely be provided.

4 Sharing and protecting personal data
We do not sell personal data. We share it only where necessary for the purposes explained in this policy, with
your consent, or as otherwise required or permitted by law. Relevant recipients may include:
 Hershesons and the relevant salon team, to provide services, coordinate customer care and address
complaints or payment-related issues.
 Service providers, supporting communications, email, website hosting, IT and business administration.
 Professional advisers, insurers and authorities, where necessary for advice, insurance or legal claims, or to
meet legal requirements.
Providers processing personal data on our behalf are required to maintain appropriate confidentiality, security,
restricted-use and deletion arrangements under applicable contractual obligations. Recipients acting as
independent controllers are responsible for their own processing under data protection law.
We use appropriate technical and organisational measures to protect personal data and restrict access to
those with an authorised need. Where required by law, we notify the regulator and affected individuals of a
personal data breach.
If our use of a provider involves a restricted transfer of personal data outside the UK, we ensure that an
applicable legal transfer mechanism is in place, such as UK adequacy regulations or approved contractual
safeguards and any further measures required by law. Contact us for details of safeguards applicable to your
information and how to obtain a copy.

5 How long information is retained
Personal data is retained only for as long as reasonably necessary for the purpose for which it is processed. We
determine the period by considering the nature of the enquiry or service, necessary customer care, applicable
legal and accounting requirements, and relevant complaint, insurance or legal claim periods. Information no
longer required is securely deleted or anonymised.
Records managed independently by Hershesons are subject to its retention arrangements. These do not
determine how long DryBy may retain separate correspondence or records for its own legitimate purposes.

6 Your rights
Subject to the conditions and exceptions in data protection law, you may:
 Request access: ask for a copy of your personal data and information about how it is used.
 Request correction: ask for inaccurate or incomplete information to be corrected.
 Request deletion: ask for your customer record or other personal data to be deleted where there is no
continuing lawful reason to retain it. This right is not absolute; legal obligations or claims may justify
continued retention.
 Request restriction: ask us to limit use of information in specified circumstances, for example while its
accuracy or an objection is being assessed.
 Object to processing: object on grounds relating to your situation where we rely on legitimate interests.
We must stop unless overriding lawful grounds or legal claims justify continuing. You may object to direct
marketing without giving a reason.
 Request data portability: receive personal data you supplied in a structured, commonly used, machine-
readable format, or request its transfer where technically feasible, when the legal conditions apply to
automated processing based on consent or contract.
 Withdraw consent: withdraw permission at any time where we rely on consent, without affecting the
lawfulness of earlier processing.
Contact us using the details in section 1. Requests are normally free and answered without undue delay,
normally within one calendar month, subject to the applicable rules on identification, clarification and
calculation of the time limit. We may request proportionate information to verify your identity. Where the law
permits an extension because of complexity or the number of requests, we will explain it within the applicable
initial period; the extension may be up to two further months.
If a request cannot be fulfilled, we will explain why and your options for challenging the decision, subject to
lawful restrictions. Where your request concerns records controlled independently by Hershesons, we will help
direct you to the relevant team. We do not make solely automated decisions producing legal or similarly
significant effects on you.

7 Cookies and external websites
Our website may use cookies or similar technologies to support its operation or understand how it is used.
Where these are used, we provide the relevant information about their purposes, providers and duration, and
obtain consent or offer an opportunity to object where required by law. This policy does not itself constitute
consent to cookies. Relevant choices may be managed through the controls provided on the website and your
browser settings.
External websites and services linked from our website have their own privacy information, which you should
review when using them.

8 Complaints and updates
You may raise a data protection complaint using the contact details in section 1. We will acknowledge it within
30 days, investigate appropriately, keep you informed as appropriate and communicate the outcome without
undue delay.
You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123
1113, and to seek a judicial remedy. We welcome the opportunity to address concerns directly, but this does
not limit those rights.
We may update this policy to reflect changes in our activities or the law. The date above identifies the latest
version. Where we introduce a new use of personal data, we will provide the further information and obtain
any consent required by law before that use begins.