Privacy Policy

This booking platform is used by independent Businesses. Two parties handle your data, in different roles:

• The Business you book with decides why and how your booking details are used for your appointments — it is an independent controller of that data. It sees your name, contact details and booking history, and may keep notes about you.
• The operator of the Platform (NextChair, “we”). For your account, sign-in and the running and security of the Platform, we are a controller. For the booking data a Business keeps in the Platform, we act as its processor, on its instructions.

Contact us about privacy at info@next-chair.co.uk.

You give us:

• Name, email address and, if you provide it, phone number.
• Your bookings: services, staff member, date and time, and any message you add.
• Preferences, such as a preferred barber, and notification settings.
• A profile picture, if you upload one.

Created while you use the Platform:

• Appointment history and status (confirmed, cancelled, completed, no-show).
• Loyalty points and rewards, if the Business runs a loyalty programme.
• Notes a Business keeps about its clients to deliver the service (for example, preferred style).
• Sign-in codes (short-lived and stored in hashed form) and session information that keeps you signed in.
• A push-notification address for your device, if you switch on push notifications.

For Staff and owners: work schedule, services offered and, if connected, the Google Calendar account used to sync appointments.

Clients added by a Business: a Business may add or import its existing clients (name, contact details, history) into the Platform. In that case the Business is responsible for having the right to do so and for telling those people.

• To provide the booking service — create and manage appointments, show availability and sign you in. Basis: performing our contract with you.
• To send booking messages — confirmations, reminders, changes and cancellations by email, push, or a WhatsApp message from the Business. Basis: performing the contract, and legitimate interest in reducing missed appointments.
• To keep the Platform safe — prevent abuse, fraud and unauthorised access, and fix errors. Basis: legitimate interest.
• To meet legal obligations — such as accounting, or responding to lawful requests. Basis: legal obligation.
• Optional features — such as push notifications or Google Calendar sync. Basis: your consent, which you can withdraw at any time.

• The Business you book with, and its Staff, who need your details to serve you.
• Service providers that run the Platform for us, such as hosting, email delivery and push-notification services, bound to use the data only for that purpose.
• Google, if a Staff member or owner connects Google Calendar — appointment details are written to their calendar.
• WhatsApp, if a Business messages you there — your phone number and the message are handled by WhatsApp under its own terms.
• Authorities, where the law requires it.

We do not sell your personal data and we do not use it for third-party advertising.

We use only what the Platform needs to work:

• Session cookie — keeps you signed in. Without it you could not use your account.
• Local storage and the app cache — remember small settings and let the installable app load offline.

These are strictly necessary and do not need consent. We do not use advertising or tracking cookies. If we ever add analytics, we will update this policy and ask for your consent where the law requires it.

We keep your account and booking data while your account is active and the Business needs it to serve you. Sign-in codes expire within minutes and are cleared soon after.

When you ask us to delete your account we remove or anonymise your data, except what we must keep by law (for example, records needed for accounting or to resolve a dispute). A Business may keep its own records of past appointments according to its legal duties.

We protect your data with encrypted connections, access controls limited to what each role needs, and hashed sign-in codes. No system is perfectly secure; if a breach affecting you occurs we will notify you and the relevant authority as the law requires.

Some of our providers (for example Google or WhatsApp, when you use those features) may process data outside your country. Where they do, we rely on appropriate safeguards such as standard contractual clauses, as required by applicable data protection law.

Depending on where you live (including under the GDPR and equivalent laws), you can:

• access the personal data we hold about you;
• correct data that is wrong or incomplete;
• ask us to delete your data;
• restrict or object to certain uses, including those based on legitimate interest;
• receive your data in a portable format;
• withdraw consent at any time, where we rely on it.

Email info@next-chair.co.uk to exercise any of these. For data a Business controls, we may pass your request to that Business. We will reply within one month. You also have the right to complain to your local data protection authority.

The Platform is not directed at children under 16, and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.

We will post any update here with a new “last updated” date and tell you about significant changes through the Platform or by email. See also our Terms of Service.