Policy review checklist

Business identity and contact

• Legal or trading name (sole trader under your own name, or another trading name?)
• Whether the business operates through a limited company (if yes, company registration details may be needed)
• Contact email for enquiries and privacy questions
• Whether you are registered with the ICO (most small businesses handling personal data need to be)

Data collection and the enquiry form

• Where enquiries will go long term (currently the form prepares a message for Instagram; an email connection has been discussed)
• Purposes and lawful basis for each use of personal information
• How long enquiry and client information is kept
• Whether any sensitive information is ever needed, and how it would be handled

Website providers and cookies

• Hosting provider for the website
• Any form, booking, email or analytics providers that handle visitor information
• Calendly is now linked for intro session bookings: confirm which Calendly account and plan, and what it stores
• Whether any provider transfers information outside the UK, and under what safeguards
• Confirm no analytics, embedded feeds or tracking have been added; if any are added, a working consent mechanism is needed before they run

Bookings, payment and cancellations

• When a booking is treated as confirmed
• How the Calendly intro session works: how long it lasts, whether it is free, and what happens afterwards
• Payment methods accepted and when payment is due (deposit, in advance, on the day?)
• Cancellation and rescheduling terms, including notice needed and any fees
• What happens if a client arrives late, or if you have to cancel
• Travel arrangements and any charges for home visits beyond the stated Colour Analysis locations
• If services can be booked remotely, the pre-contract information required for distance selling needs verification before launch

Gift vouchers

• Decide whether you want to offer gift vouchers at all
• If yes: which services or amounts they cover, how they are purchased and redeemed, expiry and booking rules, and cancellation, transfer and refund arrangements
• Until confirmed, vouchers are not presented as available to buy and there is no Gift Voucher Terms page

AI use

• The site has no customer-facing AI features, so no AI policy page is needed
• If AI is ever used to process clients’ personal information, the Privacy Notice will need to describe the tool, its purpose and how information is handled

Before publishing

• Review and approve each draft policy page
• Consider having the final wording checked by a legal professional; these drafts are not legal advice
• Only then remove the draft banners and publish