Privacy Notice

Last updated: 1 November 2026

Debut Studios respects your privacy and is committed to protecting your personal information.

This Privacy Notice explains what information we collect, why we collect it, how we use it, who we may share it with, how long we keep it and the rights you have in relation to your information.

 

1. Who we are

Debut Studios is operated by Debut Studios Tattoo Limited, company number 12514620.

 

Registered office:
1 Park Road
Hampton Wick
Kingston upon Thames
Surrey
KT1 4AS

 

Studio:
Debut Studios
36–42 New Inn Yard
Shoreditch
London
EC2A 3EY

For questions about this Privacy Notice, to exercise your data protection rights or to make a data protection complaint, contact us at:

info@debutstudios.co.uk

In this notice, “Debut”, “we”, “us” and “our” mean Debut Studios Tattoo Limited.

 

2. The information we collect

Depending on how you interact with Debut and the services you use, we may collect the following information.

 

Identity and contact information

This may include:

• your name;

• email address;

• telephone number;

• date of birth or age;

• address where relevant; and

• parent or guardian information where appropriate.

 

Enquiry and consultation information

If you submit an enquiry or consultation request, we may collect information including:

• the service or treatment you are interested in;

• your preferred artist or practitioner;

• your ideas, references or design requirements;

• budget information;

• preferred dates;

• photographs or reference images you provide;

• previous treatments or tattoos where relevant; and

• communications between you and Debut.

 

Appointment information

This may include:

• appointment dates and times;

• service or treatment booked;

• artist or practitioner;

• booking status;

• deposits and payments;

• cancellations, reschedules and no-shows;

• appointment notes; and

• your appointment history with Debut.

 

Treatment, consent and health information

Some of our services require us to collect information about your health or medical history to determine whether a treatment can be carried out safely.

This may include information about:

• medical conditions;

• allergies;

• medications;

• pregnancy;

• skin conditions;

• previous treatments;

• contraindications;

• treatment consent; and

• other relevant health information.

Health information is considered special-category personal data and receives additional protection under data protection law.

 

We only collect health information where it is relevant and necessary for the service being provided.

 

Photographs and treatment records

We may take photographs of tattoos, piercings, treatments or treatment areas where they are reasonably required for your treatment record, progress monitoring, aftercare or practitioner records.

We will obtain separate permission where photographs or other identifiable content are to be used for promotional, portfolio or social-media purposes where such permission is required.

 

Payment information

We may process information relating to:

• deposits;

• payments;

• refunds;

• transaction references; and

• payment status.

Payments may be processed by third-party payment providers. Debut does not normally retain complete payment-card information.

 

Marketing information

Where you choose to receive marketing from us, we may record:

• your email-marketing preference;

• when and how you opted in;

• the wording or version of the consent presented to you;

• whether you unsubscribe;

• your engagement with our emails; and

• information used to personalise relevant communications.

If you have provided your date of birth and have chosen to receive marketing from us, we may use your birthday to personalise communications such as a birthday email.

 

Website and technical information

When you use our website, certain technical information may be collected automatically, including:

• IP address;

• device and browser information;

• website activity;

• referral information; and

• cookie or similar technology information.

Where consent is required for non-essential cookies, we will request it through our cookie controls.

 

CCTV and security information 

CCTV operates in certain areas of our premises for security, safety and crime-prevention purposes. If you visit the studio, CCTV may capture your image and information about the date and time of your visit. 

CCTV is not used in areas where individuals would reasonably expect a high level of privacy.

 

 

3. How we collect your information

We usually collect personal information directly from you when you:

• use our website;

• submit a consultation form;

• make an enquiry;

• book an appointment;

• complete an intake, consent or medical form;

• contact us by email, telephone, WhatsApp or social media;

• attend the studio;

• make a payment;

• provide feedback;

• join our email list; or

• otherwise communicate with us.

We may also receive information through services we use to operate Debut, for example where information submitted through our website is transferred into our internal systems.

Where someone else makes an appointment on your behalf, we may receive your contact or booking information from that person.

 

4. How and why we use your information

We may use personal information to:

 

Manage enquiries and consultations

This includes reviewing enquiries, responding to consultation requests, allocating artists or practitioners, providing quotes and managing potential bookings.

 

Our lawful basis will normally be taking steps at your request before entering into a contract and/or our legitimate interests in managing enquiries and operating our studio.

 

Manage bookings and provide services

We use information to:

• create and manage appointments;

• communicate about bookings;

• take deposits and payments;

• send confirmations and reminders;

• process reschedules and cancellations;

• maintain treatment records; and

• provide the service you have requested.

 

Our lawful basis will normally be performance of a contract or taking steps at your request before entering into a contract.

 

Protect your health and safety

Where a service requires information about your health, medical history or contraindications, we use that information to assess suitability and provide the service safely.

 

We will identify an appropriate lawful basis under UK data protection law and, where required for special-category health information, an additional condition for processing that information. Where we process special-category health information, we will also identify an appropriate condition for processing under data protection law, which may include your explicit consent where appropriate.

 

Provide aftercare and customer service

We may contact you in connection with the service you received, including:

• aftercare;

• treatment information;

• appointment-related questions;

• follow-up support;

• post-visit communications; and

• genuine requests for feedback about your experience.

These communications are separate from optional marketing communications.

 

Our lawful basis may include performance of our contract with you and our legitimate interests in providing appropriate client care, maintaining service standards and dealing with concerns.

 

Manage payments, accounting and business records

We use information to process payments, deposits, refunds, accounting, tax obligations and other financial records.

 

Our lawful basis may include performance of our contract, compliance with legal obligations and our legitimate interests in properly administering the business.

 

Send marketing communications

Where permitted, we may send emails about matters such as:

• artist availability;

• studio updates;

• services and treatments;

• events;

• news;

• relevant offers; and

• other Debut updates.

Where we rely on consent for email marketing, we will ask you to make an affirmative choice to receive marketing from Debut.

 

In some circumstances we may also rely on another basis permitted under applicable direct-marketing law, including the soft opt-in where its legal requirements have been satisfied.

You can unsubscribe from marketing at any time.

 

Personalise client communications

Where appropriate, we may use information such as your previous visit date, service history, birthday or marketing preferences to determine when a relevant communication should be sent.

 

For example, we may send marketing communications at intervals after your most recent visit or send an annual birthday communication where you have chosen to receive marketing.

 

Improve and protect Debut

We may use information to:

• improve our client experience;

• manage complaints;

• prevent fraud or misuse;

• protect our staff, clients and business;

• maintain appropriate business records;

• establish, exercise or defend legal claims; and

• comply with legal, regulatory, licensing or insurance requirements.

Our lawful basis may include legal obligation and our legitimate interests in operating and protecting the business.

 

We may use CCTV footage where reasonably necessary to protect our clients, team, premises and property, prevent or investigate crime or security incidents, investigate accidents or complaints, and establish, exercise or defend legal claims. 

Our lawful basis is normally our legitimate interests in maintaining the safety and security of our premises, clients, team and property, and where applicable compliance with legal obligations.

 

 

5. Automated communications

We use software and automation to help us manage client communications efficiently.

For example, information relating to an appointment may be used to:

• determine whether an appointment has taken place;

• prevent a post-visit email being sent following a cancellation or no-show;

• send a post-visit service email;

• calculate how long it has been since a client's most recent visit;

• send marketing communications at relevant intervals where the client is eligible to receive them; and

• send birthday communications to eligible marketing subscribers.

These processes do not involve solely automated decisions which produce legal or similarly significant effects on you.

 

6. Email marketing and your choices

Receiving marketing from Debut is optional.

 

Where we ask you to opt into marketing, the marketing option will be presented separately from consent to receive a tattoo, piercing, treatment or other service.

 

Choosing not to receive marketing will not affect your ability to make an enquiry, book an appointment or receive a service from Debut.

 

Every marketing email will provide a way for you to unsubscribe.

 

If you unsubscribe, we may retain the minimum information necessary on a suppression list so that we can remember your preference and avoid accidentally sending further marketing.

 

You have a right to object to the use of your personal information for direct marketing at any time.

 

If you object or unsubscribe, we will stop using your personal information for that purpose.

 

This does not prevent us from sending genuine service communications relating to an appointment or service you have requested where those communications are otherwise lawful.

 

7. Who we share information with

We do not sell your personal information.

We may share information where reasonably necessary with:

• artists and practitioners providing your booked service;

• website and form providers;

• appointment and scheduling providers;

• customer relationship management and workflow providers;

• email and transactional communication providers;

• automation and integration providers;

• email and productivity providers;

• payment processors and banking providers;

• IT, hosting, security and analytics providers;

• accountants, lawyers, insurers and other professional advisers;

• regulators, licensing bodies, law enforcement or other authorities where legally required; and

• other service providers that help us operate Debut.

Our current technology providers may include services such as Wix, monday.com, Fresha, Google Workspace and our payment providers including Square, Revolut and Starling, depending on the particular interaction.

 

These providers may change from time to time as our business and systems evolve.

Where an artist, clinician or other practitioner acts as an independent data controller in relation to information required for their professional services, their own privacy information may also apply.

 

8. International transfers

Some of the technology and service providers we use may process or make personal information accessible outside the United Kingdom.

 

Where this constitutes a restricted international transfer under UK data protection law, we take steps designed to ensure that an appropriate level of protection is in place.

 

Depending on the destination and provider, this may include relying on:

• UK adequacy regulations;

• recognised contractual safeguards;

• the UK International Data Transfer Agreement or applicable addendum; or

• other lawful transfer mechanisms.

Further information about safeguards applying to a particular transfer can be requested using the contact details in this Privacy Notice.

 

9. How long we keep information

We do not keep personal information for longer than we reasonably need it.

 

Different types of information may need to be retained for different periods depending on why we collected it.

We consider factors including:

• the nature of the service provided;

• health and safety requirements;

• professional or practitioner requirements;

• licensing requirements;

• insurance requirements;

• tax and accounting requirements;

• applicable limitation periods for legal claims;

• complaint handling;

• safeguarding considerations;

• the age of the client; and

• whether there is an ongoing relationship with the client.

Financial and accounting records may be retained for the period required by applicable tax and company law.

 

Treatment, consent and health records may be retained for longer where reasonably necessary for client safety, insurance, professional, complaint or legal purposes.

 

Marketing information is retained for as long as you remain subscribed or where we reasonably need limited information to demonstrate how your marketing preference was obtained.

 

If you unsubscribe, we may retain limited suppression information so that we can continue to respect your request.

 

Information relating to enquiries that do not proceed may be periodically reviewed and deleted or anonymised when it is no longer reasonably required.

 

CCTV footage is retained only for as long as reasonably necessary for the purposes for which it was collected, unless footage needs to be preserved for longer in connection with an incident, complaint, investigation or legal claim.

 

10. How we protect your information

We use appropriate organisational and technical measures designed to protect personal information against unauthorised access, alteration, disclosure, loss or destruction.

 

Access to personal information is limited to people and service providers who reasonably need it for their role or to provide services to Debut.

 

However, no internet-based or electronic system can be guaranteed to be completely secure.

 

11. Your data protection rights

Depending on the circumstances and the lawful basis we rely on, you may have the right to:

• request access to the personal information we hold about you;

• ask us to correct inaccurate or incomplete information;

• ask us to erase your information;

• ask us to restrict how we use your information;

• object to certain uses of your information;

• request transfer of certain information to you or another organisation;

• withdraw consent where we rely on consent; and

• object at any time to the use of your information for direct marketing.

Some rights are subject to exemptions or do not apply in every circumstance.

Withdrawing consent does not affect processing that was lawful before consent was withdrawn.

 

To exercise your rights, contact:

info@debutstudios.co.uk

We may need to verify your identity before acting on certain requests.

 

12. Data protection complaints

If you are unhappy with how we have handled your personal information, you can make a data protection complaint to us using:

info@debutstudios.co.uk

 

We will take appropriate steps to investigate data protection concerns without undue delay and will keep you informed where appropriate. 

 

You also have the right to raise a complaint with the Information Commissioner's Office (ICO), the UK's data protection regulator.

 

We would appreciate the opportunity to address your concerns directly first, although this does not affect your right to contact the ICO.

 

13. Cookies

Our website may use cookies and similar technologies to operate correctly, understand website usage and, where applicable, support analytics or marketing functions.

 

Where consent is legally required for non-essential cookies, we will ask for it through our cookie controls.

 

You can manage your choices through the cookie settings available on our website.

 

14. Changes to this Privacy Notice

We may update this Privacy Notice from time to time, for example where:

• our services change;

• our technology providers change;

• we introduce new ways of communicating with clients; or

• data protection law or guidance changes.

The most recent version will be published on our website and the “Last updated” date above will be amended accordingly.