privacy policy

LAST UPDATED: 1 JUNE 2026

This Privacy Policy describes how Namu House Limited ("we", "us", "our") collects, uses, discloses and protects your personal information when you visit www.namuhouse.com (the "Site"), use our services, or communicate with us (collectively, the "Services"). For the purposes of applicable data protection law, including the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018, Namu House Limited is the data controller of your personal information.

By accessing or using the Site or Services, you acknowledge that you have read, understood and agree to be bound by this Privacy Policy. If you do not agree, please do not use our Site or Services.

1. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology or legal obligations. We will post the revised version on the Site and update the "Last Updated" date above. Where changes are material, we will take reasonable steps to notify you. Continued use of the Site or Services after any change constitutes acceptance of the updated policy.

2. Personal Information We Collect

The types of personal information we collect depend on how you interact with us. "Personal information" means any information that identifies, relates to, or can be associated with you.

2.1 Information You Give Us Directly

Contact details: name, address, phone number and email address.
Booking and order information: name, billing/shipping address, payment confirmation, email and phone.
Account credentials: username, password and security questions.
Customer support communications: the content of messages you send us.
Treatment Finder (Quiz) submissions: your first name, last name and email address, together with your quiz responses, collected for the purpose of sending you your results and, where you have indicated consent, relevant follow-up treatment information. We do not use this data for general marketing without your explicit consent. You may request deletion of your submission at any time by contacting us at contact@namuhouse.com.
Photographs and personal information submitted by email or contact form: if you voluntarily send us images of your skin, brows or face for treatment advice purposes, you consent to that information being reviewed by our team solely to provide the requested advice. Such photographs are handled in confidence, are not shared with third parties except where strictly necessary to provide the service, and are retained only for as long as required to respond to your enquiry. We will delete them upon request.

2.2 Information We Collect Automatically

When you interact with the Site we may automatically collect Usage Data, including device and browser information, network connection details, IP address, pages visited and time spent. We use cookies and similar technologies to collect this data, see Section 6 (Cookies) for details.

2.3 Information We Obtain from Third Parties

We may receive information about you from third-party service providers, including:

Our booking platform (Timely): your name, contact details and appointment information processed to manage your booking. Timely acts as an independent data controller and their privacy policy governs data handling within their platform.
Payment processors: payment card and billing details processed to complete transactions.
Website infrastructure providers such as Wix.
Analytics and advertising partners who collect data via tracking technologies on our Site.

Any information obtained from third parties is handled in accordance with this Privacy Policy.

3. Legal Basis for Processing (UK GDPR)

We process your personal information under one or more of the following lawful bases:

Performance of a contract (Art. 6(1)(b) UK GDPR): processing necessary to provide the Services you have booked or requested, including managing appointments, processing payments and sending transactional communications.
Legitimate interests (Art. 6(1)(f) UK GDPR): processing necessary for our legitimate interests in operating and improving the business, preventing fraud and maintaining site security, provided those interests are not overridden by your rights.
Legal obligation (Art. 6(1)(c) UK GDPR): processing necessary to comply with applicable law.
Consent (Art. 6(1)(a) UK GDPR): where we rely on your consent (for example, for marketing communications or for processing photographs you voluntarily submit). You may withdraw consent at any time without affecting the lawfulness of prior processing.

4. How We Use Your Personal Information

4.1 Providing Services

We use your information to deliver the Services, process payments, manage bookings, send appointment confirmations and transactional notifications, and maintain your account.

4.2 Marketing and Advertising

Where you have consented or where we have a legitimate interest, we may use your information to send marketing communications by email, SMS or post and to personalise advertising on our Site and other platforms. You may opt out of marketing at any time using the unsubscribe link in any email or by contacting us. Opting out does not affect transactional messages.

4.3 Security and Fraud Prevention

We use your information to detect, investigate and act on fraudulent or malicious activity and to keep our Site and Services secure.

4.4 Service Improvement and Communications

We use your information to provide customer support, respond to enquiries and improve our Services.

4.5 Use of Artificial Intelligence Tools

Namu House may use artificial intelligence tools to assist with internal operations, including drafting communications and processing information. Where AI tools are used in any client-facing capacity, we will make this clear. AI tools used by Namu House do not make clinical or treatment decisions — all treatment recommendations are reviewed and confirmed by a qualified human artist.

Any information processed through AI tools is handled in accordance with the terms of the relevant platform provider. We do not input identifiable personal data into AI tools without your explicit consent.

5. Third-Party Platforms and Service Providers

We use third-party platforms to facilitate bookings, communications and payments. By using our Site or Services, you acknowledge that certain data may be processed by these providers and that their respective privacy policies apply to such processing.

Timely (booking platform): Your name, contact details and appointment information are processed by Timely to manage your booking. Timely is an independent data controller; Namu House is not responsible for their data practices.
EmailJS / email delivery services: Where automated emails are sent to you (for example, a copy of your Treatment Finder results), these are processed via a third-party email delivery service. No sensitive personal or medical information is transmitted through these services beyond your name, email address and quiz responses.
Payment processors: Payment details are processed directly by our payment processor and are not stored by Namu House.
Wix: Website hosting and infrastructure support.
Analytics and advertising partners: These partners may collect Usage Data via cookies and similar technologies on our Site.

All third-party providers are required, by contract or applicable law, to process your data securely and only for the purposes described.

6. Cookies and Tracking Technologies

We use cookies, pixels and similar technologies to operate and improve the Site, remember your preferences, run analytics and deliver relevant advertising. You can control cookies through your browser settings; however, disabling cookies may affect functionality.

We may also permit third-party providers to set cookies on our Site for analytics and advertising purposes. Blocking cookies may not fully prevent data sharing with those partners.

7. How We Disclose Your Personal Information

We may share your personal information in the following circumstances:

With service providers acting on our behalf (IT management, payment processing, email delivery, data analytics, customer support, cloud storage).
With business and marketing partners, who will handle your data in accordance with their own privacy notices.
With third parties where you have directed us or consented to such disclosure.
Within our corporate group for legitimate business purposes.
In connection with a business transaction such as a merger, acquisition or sale of assets.
Where required by law, court order or to protect the rights and safety of Namu House, our staff, clients or others.

We do not sell your personal information. We do not use or disclose sensitive personal information for purposes beyond those for which it was collected without your explicit consent.

8. International Transfers of Personal Data

Some of our third-party service providers are based outside the United Kingdom. Where we transfer your personal data outside the UK or the European Economic Area (EEA), we ensure an adequate level of protection is in place by relying on one or more of the following safeguards:

Transfers to countries recognised by the UK Government or the European Commission as providing an adequate level of data protection.
Standard Contractual Clauses (SCCs) approved by the European Commission, or the UK equivalent International Data Transfer Agreement (IDTA) issued by the Information Commissioner's Office (ICO), as applicable.
Other appropriate safeguards permitted under UK GDPR and applicable data protection law.

If you would like further information about the safeguards in place for a specific transfer, please contact us using the details in Section 12.

9. Children's Data

Our Services are not directed to children under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please contact us and we will delete it promptly. We do not knowingly sell or share the personal information of individuals under 16.

10. Security and Retention of Your Information

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, loss, destruction or alteration. However, no method of transmission over the internet or electronic storage is completely secure; we cannot guarantee absolute security. We recommend that you do not use insecure channels to communicate sensitive information to us.

We retain personal information for as long as necessary to fulfil the purposes for which it was collected, including to maintain your account, provide the Services, comply with legal obligations, resolve disputes and enforce our agreements. When retention is no longer necessary, we securely delete or anonymise your data.

11. Your Rights Under UK GDPR

Depending on your location and the applicable law, you may have the following rights in relation to your personal information. These rights are not absolute and may be subject to exceptions permitted by law:

Right to Access / Know: to request a copy of the personal information we hold about you and information about how we use and share it.
Right to Rectification / Correct: to request correction of inaccurate or incomplete personal information.
Right to Erasure / Delete: to request deletion of your personal information in certain circumstances.
Right to Restriction of Processing: to ask us to restrict processing of your data in certain circumstances.
Right to Data Portability: to receive your personal information in a structured, commonly used and machine-readable format and, where technically feasible, to have it transferred to another controller.
Right to Object: to object to processing based on legitimate interests or for direct marketing purposes.
Right to Withdraw Consent: where processing is based on consent, to withdraw that consent at any time without affecting the lawfulness of prior processing.
Right to Appeal: to appeal our decision if we decline to act on your request.
Right to Manage Communications: to opt out of marketing emails at any time via the unsubscribe link.

To exercise any of the above rights, please contact us using the details in Section 12. We will respond within 30 days of receipt. We may need to verify your identity before acting on your request. We will not discriminate against you for exercising your rights.

You may also designate an authorised agent to make requests on your behalf, provided that agent supplies proof of authorisation and we are able to verify your identity.

12. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your rights, or have a complaint about how we handle your personal information, please contact us at:

Namu House Limited

Email: contact@namuhouse.com

Website: www.namuhouse.com/privacy-policy

13. Complaints

If you are not satisfied with our response to a complaint, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection:

Information Commissioner's Office

Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Helpline: 0303 123 1113

Website: https://www.ico.org.uk/make-a-complaint

If you are located in the EEA, you may also lodge a complaint with the relevant data protection supervisory authority in your country of residence.

14. Third-Party Websites and Links

Our Site may contain links to third-party websites or platforms. We are not responsible for the privacy practices or content of those sites. We encourage you to review their privacy policies before providing any personal information. Our inclusion of such links does not imply any endorsement.