Privacy Policy

Mykola Shkurin trading as Myshukrin, of 1 Peatland Quadrant, Kilmarnock KA1 4PN, is the data controller for everything described on this page. This is one person trading under a business name rather than a company, so there is no company number to quote and no data protection officer: the person responsible is the person who answers production@myshukrin.com.

Everything below is the information the UK GDPR requires a controller to give when it collects personal data (Article 13), set out in the order the Information Commissioner’s own checklist asks for it.

An enquiry carries what you put in it: your name, your email address, the name of your salon or barbershop if you give one, how many people take bookings, how many treatments you want bookable, how bookings reach you now, your website address if you give one, and whatever you write in your own words.

None of it is required by law and none of it is sought beyond what a reply needs. An enquiry that does not turn into work is deleted twelve months after the last message in it. An enquiry that does turn into work becomes part of the record of that work, and is kept as described under records of work and money.

The form on the Contact page runs entirely in your own browser. It checks what you typed, works out which setup the numbers fall into and assembles the text of the enquiry, and none of that leaves the machine you are sitting at.

Pressing the button hands the finished text to your own email program, with the subject line filled in. It is you who presses send in that program, and until you do, nothing has been transmitted to anybody. This website has no server of its own that could receive it: the pages are files, served as they are, with nothing behind them to write to.

This site sets no cookies. It writes nothing to local storage or session storage, it uses no analytics, no advertising tags, no embedded videos, no maps, no chat widget and no font service: the typefaces are served from this site’s own address along with everything else.

That is why there is no banner asking you to accept anything. Regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 asks for consent before storing or accessing information on your device; nothing here does either, so there is nothing to consent to. If that ever changes, the banner arrives with the change and this clause changes with it.

Serving a page leaves an entry in the hosting provider’s log: the address requested, the time, the internet address the request came from, the browser’s own description of itself. That is how the web works and it happens on every site you visit, this one included.

Those logs are kept for 30 days and are used for keeping the site up and for dealing with abuse. They are not used to build a picture of anybody, they are not combined with enquiries, and they are not passed to anybody for marketing.

Where an enquiry becomes an order, the record of it — the confirmation, the invoice, what was agreed and what was done — is kept for six years after the end of the tax year it belongs to, because tax law requires records to be kept and produced on request.

That period is not a choice and it is why a request to delete everything cannot always be met in full. The rest can be, and is: see your rights over it.

Three lawful bases, and no others:

• A contract, or the steps before one (Article 6(1)(b)). Answering your enquiry, quoting for the work, and doing it.
• Legitimate interests (Article 6(1)(f)). Keeping a record of what was asked and what was answered, so that a disagreement about what was agreed can be settled by looking rather than by remembering. The interest is a small one and it is balanced against your side of it by keeping enquiries for a fixed twelve months and no longer.
• A legal obligation (Article 6(1)(c)). Keeping accounting records for six years.

Consent is not relied on for any of this, which is why there is no consent to withdraw. Nothing is used for marketing: there is no mailing list here, and writing once does not put you on one.

The hosting provider that serves these pages, which sees the server logs described above. The email provider that carries the mailbox, which sees anything you send to it. An accountant, if one is appointed, who sees invoices and the records behind them.

None of them is named here yet, because naming a provider before there is a contract with one would be a false statement about somebody else’s business. Whoever they turn out to be is named in writing to anybody who asks, and this page is updated when they are appointed.

Nobody else. Your details are not sold, not shared for marketing, and not handed to anybody who has no part in doing the work you asked for.

Nothing is deliberately sent outside the United Kingdom. Where a provider that carries the pages or the mailbox processes data outside it, that provider is chosen on the footing that the transfer is covered either by the United Kingdom’s own adequacy regulations for the country concerned, or by the standard contractual terms the Information Commissioner has approved for the purpose.

A copy of the terms relied on for a particular provider is available on request once that provider is appointed.

You may ask for a copy of what is held about you; ask for anything wrong in it to be corrected; ask for it to be deleted; ask for its use to be restricted while a disagreement is sorted out; object to it being held on the legitimate-interests basis above; and ask for what you gave to be handed back in a portable form.

Write to production@myshukrin.com and say which of those you want. There is no charge, and an answer comes within one month, which is the period the UK GDPR allows. Where something cannot be done — the six-year accounting records are the usual case — you are told why rather than told no.

Write to me first: it is faster, and most of what goes wrong is a mistake rather than a policy. If that does not settle it, you may complain to the Information Commissioner’s Office, which regulates data protection in the United Kingdom, at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, or through ico.org.uk.

Complaining to me first is not a condition of complaining to them.

There are none. Nothing here decides anything about you by machine, nothing scores you, and nothing builds a profile of you. The one piece of arithmetic on the site — which setup your numbers fall into — runs in your browser, produces a suggestion rather than a decision, and is checked by a person before any figure is confirmed.

No. Nothing on this site is required by law or by contract. A name and an email address are needed to answer you at all, and the counts are needed to say which setup fits; without them the reply is a guess, which helps nobody. Everything else can be left empty.

This page is revised when what it describes changes — a hosting provider appointed, an accountant engaged, anything that alters where your details go. The date of the current revision is at the head of the page, and the version in force when you wrote is the one that governed what happened to that enquiry.