Privacy Policy
This policy explains what personal data we collect when you message our Facebook Page on Messenger or chat with us on our website, why we collect it, who we share it with, how long we keep it, and the rights you have under UK data protection law (the UK GDPR and the Data Protection Act 2018).
1. Who we are
The data controller is Bamboo Nail Lab, 168–170 Newgate Street, Bishop Auckland, DL14 7EN, United Kingdom.
Contact for anything about your personal data: admin@bamboonaillab.com. You can also send us a message on Messenger.
2. What we collect
- Your messages: the text you send us, and any photos or files you choose to send.
- Your Messenger identifier: Meta gives us an ID that is specific to our Page, so we can reply to you and keep your conversation together. We do not receive your Facebook password or your friends list.
- Order details you give us: for example your name, phone number, delivery address and postcode, the products and quantities you order, and the order and payment status.
- Notes from our staff: notes our team adds to help with your enquiry or order.
- Technical records: timestamps, delivery status of messages and security logs, kept so the service works reliably and safely.
Please do not send card numbers, passwords or health information in the chat.
3. Why we use it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Taking, preparing and delivering your order, and dealing with returns or problems | Contract (to take steps you ask for and to perform our contract with you) |
| Answering your questions about our products and services | Legitimate interests (responding to people who contact us) |
| Passing your conversation to a member of staff when needed, and staff follow-up | Legitimate interests (good customer service) |
| Keeping the service secure and preventing misuse | Legitimate interests (security) |
| Keeping sales and accounting records | Legal obligation |
We do not use your data for advertising, and we do not sell it.
4. Automated replies
Many replies are written by an automated assistant that uses an AI language model and our own product information. Our staff can see the conversations and can take over at any time; ask for a member of staff whenever you like. The assistant does not make decisions about you that have legal or similarly significant effects: orders and any problems are handled by our staff.
5. Who we share it with
We use these service providers. They act on our instructions, except Meta, which also acts for its own purposes under its own terms:
- Meta Platforms – runs Messenger and delivers messages between you and us (Meta Privacy Policy).
- Google Cloud – hosts the system that receives and answers messages, in London, United Kingdom.
- Cloudflare – provides our secure network connection, our staff dashboard and its database (stored in the European Union), and the gateway we use to reach the AI model.
- Google (Gemini API) – the AI model that drafts the assistant's replies. The conversation needed to answer you is sent to the model each time it replies.
- Delivery companies – your name, address and phone number when we send you an order.
We may also disclose data where the law requires it.
6. International transfers
Some of these providers may process data outside the UK, including in the European Union and the United States. When they do, we rely on UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework where the provider is certified) or on the International Data Transfer Addendum to the EU standard contractual clauses.
7. How long we keep it
We keep conversations for 24 months after your last message. We keep order records for 6 years after the end of the financial year in which the order was made, because UK tax and accounting law requires it.
After that we delete the data, or anonymise it so it no longer identifies you.
8. Your rights
You have the right to:
- ask for a copy of your personal data;
- ask us to correct data that is wrong;
- ask us to delete your data;
- ask us to restrict how we use it, or object to our use of it based on legitimate interests;
- receive data you gave us in a portable format.
To use any of these rights, email admin@bamboonaillab.com or message us on Messenger. We reply within one month. It is free of charge.
If you are unhappy with how we handle your data, please tell us first. You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, 0303 123 1113.
9. How to delete your data
- Send us a message on Messenger saying "Please delete my data", or email admin@bamboonaillab.com with the name you use on Facebook.
- We confirm who you are using the same Messenger conversation, so we do not delete someone else's data by mistake.
- We delete your messages and profile data within 30 days and confirm when it is done. We may keep order records that the law requires us to keep; we tell you if this applies.
Deleting the conversation in your Messenger app removes it only from your device and account; it does not delete our copy. Please ask us as above.
10. Security
Only authorised staff can see conversations, through a dashboard that requires sign-in. Data is encrypted in transit, and access to our systems is limited and logged.
11. Children
Our chat is not intended for children under 13. If you believe a child has sent us personal data, please contact us and we will delete it.
12. Changes to this policy
If we change this policy we update the date at the top of this page. If the change is significant, we will tell you in the chat.