Businesses we email

1. Who we are

We're HAMR Ltd, trading as Covered Beauty. We're registered in England and Wales, company number 17190046, and our registered office is 25 Lowther Street, Whitehaven, CA28 7DG.

We decide how your details are used, so we're the "controller" under UK data protection law. We haven't appointed a Data Protection Officer. For anything about your data, email hello@covered.technology or reply to any email we've sent you.

2. Where we got your details

• Your business's own website. That's where your business email address is published, and where we read about what you offer.
• The public Companies House register. We check that your business is a company, LLP or Scottish partnership, that it's active, and its company number.
• OpenStreetMap, a free public map. Sometimes that's where we first find your business's name, town, address and website.

All of this is publicly available. We don't buy, rent or swap lists, and we don't take email addresses from social media or booking directories.

3. What we hold

• your business name, town and type of business (for example nails or lashes)
• the business email address on your website, the page we found it on and the date we found it
• your website address
• your business's postal address, from your own website or OpenStreetMap, in case we post you a card
• your company number and registered company name
• one sentence about your business that we write from your own website to open our email (for example, that you've just added a new treatment), and the words on your site it's based on
• what we sent you and when, and whether it bounced
• if you reply, your reply, and whether you said yes, no or asked a question
• whether a link to your page in our email was clicked, and whether your page was visited (see the next section)

We don't look up or record the names of owners or staff, and we don't use the Companies House lists of directors or owners. If your business email address includes a person's name, it may count as personal data, and this notice covers it.

4. Clicks and visits

The links to your page in our email are unique to your business. When one is clicked, we record the click, and when your page is visited, we record the visit. That page shows what a booking page for your business could look like.

Each record has the date and time and a short label for what made it, such as "a web browser" or "a link checker" (some email systems check links before you see them). If you go on to our website from that page, our visitor counter also notes whether it was on a phone or a computer, and the website you came from. We don't record your IP address or your location, and we don't use cookies for this.

We don't record whether our emails are opened. The picture in our email is the same for everyone and comes from this website, so loading it tells us nothing about you.

We use these records to see which emails work and whether to send a follow-up. We delete them after 90 days. After that we keep only the number of clicks and when the first click and first visit happened, until your details are deleted (see How long we keep it).

5. Why we use it, and our legal basis

We use your details only to:

• tell your business about Covered Beauty, in three emails at most
• see which of our emails work, and whether to send a follow-up
• answer you if you reply
• make sure we never email you again once you've said no

Our legal basis is legitimate interests (UK GDPR Article 6(1)(f)). Our interest is telling beauty businesses that might find Covered Beauty useful about it. We've weighed that against your interests: we only use business email addresses published for business enquiries, we send a few short emails at most, and you can stop them at any time. You can ask us for a copy of our assessment.

6. Who handles it for us

We don't sell your details or give them to anyone for their own use. These companies handle them for us, under contract and only on our instructions:

• InstantlySends our emails, holds our list while we're emailing you, and keeps a block list of addresses we must not email.
• Google WorkspaceThe mailboxes our emails come from and your replies arrive in.
• Microsoft 365Our hello@covered.technology mailbox.
• SupabaseOur database, stored in London.
• VercelHosts this website and our app.
• AnthropicAn AI service that helps us write the sentence about your business and sort replies, so a "no thanks" is acted on straight away.
• Our printerPrints and posts our cards, if we send you one.

7. Transfers outside the UK

Our database is in London, but most of these companies are based in the USA, so your details may be stored in or reached from there. When that happens, the transfer is protected by the UK-US data bridge, where the company has signed up to it, or by the UK International Data Transfer Addendum to the EU standard contractual clauses in its data processing terms.

Email us if you'd like details of the safeguard for any of them.

8. How long we keep it

• If we never email you: we delete your details 30 days after we find them.
• If we email you and you don't reply, or you reply "no": we delete them 90 days after our last email.
• If you reply (other than to say no): we keep them for up to a year after we last spoke.
• If we post you a card: we keep them until 90 days after we posted it, if that's later.
• Click and visit records: deleted after 90 days.
• If you sign up: your details become part of your Covered Beauty account, and our main privacy notice applies.
• If you ask us to stop: we keep a scrambled copy of your email address (a one-way code that can't be turned back into the address), your website's domain and your company number. We keep these for good, because that's how we make sure we never email you again.
• If our email bounces: we keep a scrambled copy of the address for good, so we never try it again.
• Our sending provider: after a stop or a bounce, it keeps the address on its block list for good, for the same reason (after a stop, your website's domain too). Until it has it, usually within minutes, we also keep the address itself.

9. Your rights

You have the right to:

• object to our emails at any time. This right is absolute. We'll stop straight away and won't ask why.
• see what we hold about you, and get a copy
• correct anything that's wrong
• have it deleted
• restrict how we use it

To use any of these rights, email hello@covered.technology. It's free, and we'll reply within one month. If you ask us to delete your details, we'll still keep the scrambled copy described above, so we don't email you again by mistake.

10. How to stop our emails

Any of these works:

• reply "no" or "stop" to any of our emails
• use the unsubscribe link in our email, or the Unsubscribe option your email app shows at the top of it. There's no login and no questions.
• email hello@covered.technology

We stop straight away, and we won't send an email to confirm it. Stopping covers your whole business: every address at your website's domain, and your company number.

11. Complaints

If you're unhappy with how we've used your details, please tell us at hello@covered.technology. We'll acknowledge your complaint within 30 days, look into it, and tell you what we've done.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.

12. Automated decisions

We don't make any decisions about you by automated means that have a legal or similarly significant effect on you.

13. Changes to this notice

If we change this notice, we'll update it here and change the date at the top.