Privacy Policy

9. Privacy Policy

9.1 About this Privacy Policy

This Privacy Policy explains how Allure Ink / Allure Aesthetics Studio, referred to as Allure Ink, the studio, we, us or our, collects, holds, uses and discloses personal information.

It applies when a person visits www.allureink.com.au, uses the studio’s Timely booking services, creates or uses a client account, makes an enquiry, booking or purchase, receives a service, enters a promotion, communicates with the studio or otherwise interacts with the studio’s services.

In this policy, you and your mean the client, purchaser, website visitor, competition entrant, enquiry sender or other individual whose personal information the studio handles.

9.2 Privacy commitments and consent

The studio aims to manage personal information openly, securely and consistently with the Australian Privacy Principles where they apply. Where the Privacy Act 1988 does not apply to a particular activity, the studio will still use this policy as its minimum privacy standard where reasonably practicable.

This policy provides notice of the studio’s information-handling practices. It is not a blanket consent to every collection, use or disclosure. The studio will obtain separate consent where required, including for sensitive health information, promotional media and direct marketing where applicable.

If a person does not provide information reasonably required for a booking, consultation, suitability assessment, payment or treatment record, the studio may be unable to provide the relevant service or feature.

9.3 Personal information collected

Depending on the person’s interaction with the studio, the studio may collect and hold:

  • Name, date of birth, gender or pronouns where provided, address and contact details

  • Emergency-contact information where reasonably required

  • Timely client number, account, login, authentication and communication preferences

  • Appointment history, booked services, cancellations, attendance records and practitioner information

  • Product, package, gift-card, rewards, store-credit and transaction history

  • Billing and delivery information, payment confirmation, payment method and payment status

  • Enquiries, complaints, feedback, correspondence and customer-support information

  • Competition entries, referral sources, social-media usernames and promotional eligibility information

  • Website and booking-platform usage information described in section 9.9

  • Photographs, videos, audio and media-consent preferences

  • Any other information a person voluntarily provides or that is reasonably necessary for the relevant interaction

9.4 Sensitive and health information

To assess treatment suitability and provide services safely, the studio may collect sensitive information, including:

  • Medical history and relevant health conditions

  • Allergies, medications and previous procedures

  • Pregnancy, breastfeeding and hormonal information where relevant

  • Skin conditions, sensitivities, healing history and contraindications

  • Information about infections, blood-borne risks or immune response where relevant

  • Treatment notes, consultation responses, consent forms and aftercare records

  • Treatment photographs and images that reveal health or treatment information

The studio will collect sensitive information only where it is reasonably necessary for a legitimate treatment, safety, legal or business function and where the required consent or other lawful authority exists.

Sensitive information will not be used to infer characteristics for unrelated advertising or disclosed for another business’s marketing merely because it appears in a client record.

9.5 How information is collected

The studio may collect personal information:

  • Directly from the individual through Timely, Timely Consult, the website, online booking, forms, telephone, SMS, email, social media or in-person communication

  • From a purchaser or person making a booking for the client

  • During consultation, treatment, photography, aftercare and follow-up

  • From Squarespace when a person uses the website or submits a website form

  • From payment providers when a payment is attempted, completed, declined, reversed or disputed

  • From social-media and advertising platforms when a person interacts with studio content or an advertisement

  • From a competition or promotional partner where this was disclosed and authorised

  • From publicly available sources or another lawful source where reasonably necessary

Where practical, the studio will collect information directly from the individual. If information is provided by another person, the studio may verify it with the client before relying on it for treatment, payment or another important decision.

9.6 Timely client records and storage

Timely is the studio’s primary client-management, booking and treatment-record platform. Client contact details, appointment history, consultation information, consent records, treatment notes, client documents, images, account balances, gift cards, rewards, store credit and related information may be stored in the client’s Timely record.

Allure Ink determines what client information is entered into Timely and how the studio uses it. Timely Limited and its authorised subprocessors provide the software, hosting, communications, support, payment and related technical services needed to operate the platform.

Timely may use cloud infrastructure and subprocessors located in Australia and overseas, including in the United States, New Zealand and Spain. Provider locations and subprocessors may change over time.

9.7 Payment information

Payments may be processed through TimelyPay, Stripe, Afterpay, EFTPOS, American Express, another card network, a banking provider or another accepted payment provider.

The studio may receive payment confirmation, transaction identifiers, payment status, limited card descriptors and information needed to reconcile or recover a payment. Full card numbers and security codes should not be entered into ordinary Timely notes, emails, messages or consultation forms.

Where a client authorises a card to be saved, the card is stored through the secure payment provider rather than as full card details in the studio’s client notes. The client and studio may have limited controls to add, select or remove a saved payment method through Timely, subject to the payment provider’s security and booking requirements.

9.8 Website, Squarespace and online purchases

The studio’s website is operated using Squarespace. When a person visits the website, submits a form, views services or products, creates or uses an available account feature or makes an online purchase, Squarespace and connected services may process information needed to deliver that functionality.

This may include contact, enquiry, order, billing, shipping, cart, account, device and usage information. The information collected depends on the website features used at the time.

Client treatment records are stored primarily in Timely. Website-visitor data, online-form submissions, order data and technical usage information may also be processed or temporarily retained by Squarespace and connected website services.

9.9 Cookies, pixels and usage data

The website and connected services may use cookies, pixels, web beacons and similar technologies. These technologies may collect:

  • IP address and approximate location derived from it

  • Device, operating-system and browser information

  • Referral source and pages viewed

  • Dates, times, interactions and navigation through the website

  • Advertising identifiers and information about interactions with studio advertisements

  • Preferences and information needed to maintain website or account functionality

Cookies may be used to operate and secure the website, remember preferences, analyse performance, understand how visitors use the website and measure or tailor advertising.

Where a consent control is provided, visitors may use it to manage non-essential cookies. Browser settings may also be used to block or delete cookies, although doing so may affect website functionality. Blocking cookies may not prevent every form of measurement or information processing by connected services.

The studio will take reasonable steps to prevent health information or confidential consultation information from being intentionally transmitted through advertising pixels.

9.10 How personal information is used

The studio may use personal information to:

  • Respond to enquiries and provide customer support

  • Create, maintain and update Timely client records

  • Make, confirm, remind, reschedule and manage appointments

  • Assess treatment suitability and obtain informed consent

  • Provide, document and follow up services and aftercare

  • Process purchases, payments, deposits, refunds, exchanges, gift cards, rewards and store credit

  • Apply the studio’s cancellation, no-show, payment and other accepted policies

  • Deliver products and administer returns or exchanges

  • Operate the website, booking services and client account features

  • Administer competitions, referrals, promotions, model services and collaborations

  • Manage media permissions and use authorised content

  • Detect and address fraud, misuse, security incidents, payment disputes and unlawful conduct

  • Maintain business, insurance, accounting, tax, legal and regulatory records

  • Recover lawful outstanding amounts and resolve complaints or disputes

  • Analyse and improve services, client experience, website performance and business operations

  • Comply with legal obligations and protect the rights, safety and property of clients, staff, the studio and others

The studio will not use information for a materially different purpose without consent or another lawful basis where one is required.

9.11 Appointment and service communications

The studio may use contact details to send communications reasonably connected with a booking, purchase, treatment or client relationship. These may include confirmations, reminders, preparation instructions, consultation forms, payment requests, receipts, aftercare, safety information and responses to enquiries.

These operational communications are not marketing merely because they identify the studio or relate to a purchased service. A client who opts out of marketing may still receive necessary transactional, appointment, payment, safety and treatment communications.

9.12 Marketing and advertising

The studio may send promotional email or SMS only where the recipient has provided the required consent or another lawful basis exists. Competition entry, a one-off purchase or an enquiry will not automatically be treated as consent to ongoing electronic marketing.

Marketing messages will identify the sender and provide a functional way to unsubscribe. Unsubscribe requests will be processed without charge and within the period required by law.

The studio may use non-sensitive contact, transaction and interaction information to tailor marketing where lawful and reasonably expected. Sensitive health information will not be used for direct marketing without the consent required by law.

A person may withdraw marketing consent through the unsubscribe facility or by contacting admin@allureink.com.au. Withdrawing marketing consent does not withdraw consent to necessary service communications or an independently accepted Media Release.

9.13 When information may be disclosed

The studio may disclose personal information where reasonably necessary to:

  • Staff members and contractors who need the information to perform their duties

  • Timely Limited and its subprocessors

  • Squarespace and connected website, hosting, analytics and commerce providers

  • Payment processors, card networks, banks and Afterpay

  • Email, SMS and communications providers

  • Delivery, fulfilment and product suppliers where relevant

  • IT, cybersecurity, data-storage and technical-support providers

  • Accountants, insurers, auditors, lawyers and other professional advisers

  • Debt-recovery providers, tribunals and courts for a lawful outstanding amount or dispute

  • Advertising, design, website and social-media providers for information authorised for that purpose

  • Competition and promotional partners where disclosure was notified and is necessary to administer the promotion or provide a prize

  • Government, regulatory, law-enforcement, emergency or health authorities where authorised or required by law

  • A prospective purchaser, successor or adviser involved in a genuine sale, restructure or transfer of the business, subject to appropriate confidentiality and legal safeguards

The studio will not sell client health records or disclose sensitive information to an unrelated party for its own direct marketing.

9.14 Overseas processing and disclosure

Some service providers operate or use infrastructure outside Australia. Personal information may therefore be processed or accessible in countries including the United States, New Zealand and Spain, as well as other countries identified in the current privacy information of Timely, Squarespace, payment, communications, website, advertising and social-media providers.

The exact location may depend on the provider, feature and technical infrastructure used. The studio will take reasonable steps appropriate to the circumstances to select reputable providers, limit disclosure to what is reasonably required and address applicable cross-border privacy obligations.

Information or media intentionally published on the internet may be accessible throughout the world and may no longer remain within the studio’s effective control after it is copied or shared by others.

9.15 Data quality and client responsibilities

The studio will take reasonable steps to keep personal information accurate, current, complete, relevant and not misleading for the purpose for which it is held.

Clients should provide accurate information and promptly notify the studio of changes to their contact details, medical information, medications, pregnancy status, allergies or another matter relevant to treatment or communication.

9.16 Security

The studio uses reasonable administrative, technical and physical safeguards appropriate to the information it holds. These may include restricted Timely access, individual staff accounts, access controls, secure payment processing, device security, passwords, multi-factor authentication where available, staff confidentiality requirements and procedures for handling documents and media.

No internet transmission or storage system can be guaranteed to be completely secure. A person who believes their Timely client login, gift-card code or another account credential has been compromised should contact the studio promptly.

9.17 Retention and deletion

The studio retains personal information for as long as reasonably required to provide services, maintain accurate treatment and transaction records, meet insurance, accounting, tax, health, safety and legal obligations, resolve disputes and enforce agreements.

Retention periods vary according to the type of information, the client’s age, the treatment provided and the reason the record is held. When information is no longer reasonably required and the studio is not legally required or permitted to retain it, the studio will take reasonable steps to delete or de-identify it.

Deletion from an active Timely record may not immediately remove information from secure backups, audit logs, payment-provider records or material already lawfully published. Those copies will be handled under the applicable provider, legal and retention requirements.

9.18 Accessing and correcting personal information

A person may request access to personal information the studio holds about them or ask for inaccurate, out-of-date, incomplete, irrelevant or misleading information to be corrected.

Requests should be sent to admin@allureink.com.au and include enough information for the studio to identify the person and the requested record. The studio may require reasonable proof of identity or authority before providing access or making a correction.

The studio will respond within a reasonable period and will ordinarily aim to respond within 30 days. Access or correction may be refused or limited where permitted or required by law, including where disclosure would unreasonably affect another person’s privacy, create a serious safety risk or reveal information that cannot legally be disclosed. Where appropriate, the studio will explain the reason and available complaint process.

9.19 Anonymity and pseudonyms

A person may browse general website information without identifying themselves where the website functionality permits.

The studio cannot ordinarily provide a booked treatment, maintain a reliable treatment record, assess medical suitability, process certain payments or comply with legal and insurance requirements anonymously or under a pseudonym. Where identification is not reasonably required, the studio will consider whether anonymous or pseudonymous communication is practicable.

9.20 Privacy incidents and data breaches

The studio will investigate suspected loss, unauthorised access, misuse or disclosure of personal information and take reasonable containment and remedial steps.

Where the Notifiable Data Breaches scheme or another notification requirement applies, the studio will assess the incident and notify affected individuals and the appropriate regulator when legally required.

9.21 Children and authorised representatives

The studio will take additional care when handling information about a minor or a person who requires an authorised representative.

Where required, the studio may collect and verify information about a parent, guardian or authorised decision-maker. The studio will still involve the client in privacy and treatment decisions to the extent appropriate to their age, understanding and legal capacity.

9.22 Third-party websites, platforms and links

The website, booking communications and social-media pages may contain links to third-party websites, applications or services. Those third parties have their own privacy, security and cookie practices.

The studio is responsible for its own handling of personal information and for taking reasonable care when selecting providers. It does not control an unrelated third party’s independent website or information handling merely because a link is provided.

9.23 Privacy questions and complaints

A person may raise a privacy question or complaint by contacting:

The studio will acknowledge and investigate the concern, may request further information and will aim to provide a substantive response within 30 days.

If the complaint is not resolved, the person may be entitled to contact the Office of the Australian Information Commissioner or another regulator with jurisdiction over the matter. The studio will provide reasonable information about an available external complaint option where required.

9.24 Changes to this Privacy Policy

The studio may update this Privacy Policy to reflect changes in information-handling practices, services, technology, providers, legal requirements or business operations.

The revised policy will be posted on the website with an updated effective or last-updated date. Where a material change affects an existing consent or significantly changes how previously collected sensitive information will be used or disclosed, the studio will provide further notice or obtain consent where required.

9.25 Availability and statutory rights

This Privacy Policy will be made available free of charge through the website. A person may contact the studio to request it in another reasonably accessible form.

Nothing in this policy excludes, restricts or modifies a privacy, consumer or other legal right that cannot lawfully be excluded, restricted or modified.