Your information
Privacy policy
What personal information Transform by Mon collects, why, who sees it, how long we keep it and what you can ask us to do with it.
Last updated: 28 October 2026
On this page
- 1. Who we are
- 2. What we collect and why
- 3. Bookings, deposits and payments
- 4. Your health information
- 5. Photos of your treatment
- 6. Cookies
- 7. Newsletter and course waitlists
- 8. Who we share it with
- 9. Information sent outside Ireland
- 10. How we protect it
- 11. Your rights
- 12. Complaints
- 13. Children
- 14. Changes to this policy
This policy covers our website transformbymon.ie, the salon and the academy at 12 High St, Tralee.
1. Who we are
The data controller is Monika Banach, trading as Transform by Mon.
- Address
- 12 High St, Tralee, Co. Kerry, V92 KT20, Ireland
- Phone
- +353 83 877 7217
We do not have a Data Protection Officer, because a business of our size does not need one. Write to us at the email above with any question about your data.
2. What we collect and why
| What you do | What we collect | Why | Legal basis | How long we keep it |
|---|---|---|---|---|
| Book a treatment or a course | Name, email, phone, the service, date and time, notes you add, your deposit payment | To hold your appointment, remind you of it and take your deposit | A contract with you (Article 6(1)(b) GDPR) | 6 years |
| Fill in an intake and consent form | Health information, see section 4 | To check the treatment is safe for you and record your consent | Your explicit consent (Article 9(2)(a) GDPR) | 7 years after your last treatment |
| Order from our shop | Name, email, phone, delivery and billing address, what you ordered, payment status | To send your order, handle returns and keep tax records | A contract with you, and our legal duty to keep accounts (Article 6(1)(b) and (c)) | 6 years |
| Send us a message | Name, email, phone if you give it, your message. Please leave health details out of messages. If you send them, we use them only to reply and send you the intake form | To reply to you | Our legitimate interest in answering questions (Article 6(1)(f)) | 12 months, then we delete the message |
| Join the newsletter | Email, first name | To send you new dates, offers and aftercare tips | Your consent (Article 6(1)(a)) | Until you unsubscribe |
| Join a course waitlist | Email, first name, phone if you give it, the course | To tell you when dates for that course are published, which is what you asked for | Taking steps you asked for before a contract (Article 6(1)(b)) | Until you leave the list, or 24 months |
| Create a member account | Name, email, password (stored by Wix, we cannot see it), your bookings and orders. Signing up with Google or Facebook shares your name and email with us | To let you see and manage your bookings and orders | A contract with you (Article 6(1)(b)) | Until you ask us to close it. Signed intake forms are kept for the period in section 4 |
| Visit the website | Cookies and device information, see section 6 | To run the site, and with your consent to measure visits | Necessary cookies: our legitimate interest. Analytics and marketing: your consent | See section 6 |
We only ask for what we need. If you do not give the details marked as required, we cannot book you in, send your order or reply to you.
3. Bookings, deposits and payments
When you book online, Wix Bookings stores your booking for us. You pay your deposit, or the full price of a shop order, through Wix Payments. The payment provider handles your card details. We see your name, the amount and whether the payment went through. We never see or keep your full card number.
If you choose to save a card, Wix Payments keeps it in My Wallet in your account, and you can remove it there at any time.
We send you a booking confirmation and a reminder by email.
4. Your health information
Before some treatments we ask you to fill in an intake and consent form. There are four:
- Permanent makeup (PMU)
- Dermal filler
- PMU and tattoo removal
- Advanced skin treatments (for example microneedling, SQT bio needling, chemical peel, carbon peel)
Health information is special category data under the GDPR. We treat it with extra care.
What we ask. Your medical conditions, medicines you take, allergies, skin conditions and sensitivities, whether you are pregnant or breastfeeding, recent cosmetic treatments, and your signature to agree to the treatment.
Why. To check the treatment is safe and suitable for you, to plan it, and to keep a record that you agreed to it after we explained it.
Legal basis. Your explicit consent (Article 9(2)(a) GDPR). You give it by ticking the consent box and signing the form. We cannot carry out these treatments without the form, because without it we cannot check they are safe for you.
Who sees it. Monika Banach. Wix stores the form for us as our processor. We do not email your form to ourselves. We do not keep paper copies. We never use your health information for marketing. We never pass it to anyone else, unless the law requires it.
How long. We keep the form for 7 years after your last treatment, then we delete it.
Withdrawing consent. You can withdraw your consent at any time by emailing us. We then stop using the form for any new treatment. We may keep the signed form we already have, for the period above, only to deal with a legal claim about a treatment you had (Article 9(2)(f) GDPR).
You must be 18 or older to have a treatment with us.
5. Photos of your treatment
We only photograph your treatment if you agree. You can agree to a photo for your client record and say no to it being shown online. If you agree to a photo on our website or social media, you can change your mind at any time. We then remove it from our website and our own accounts. We cannot recall a post someone else has already shared.
6. Cookies
When you first visit, a cookie banner asks for your choice. Analytics and marketing cookies only run if you accept them.
| Type | What it does | When it runs |
|---|---|---|
| Necessary | Keeps the site secure, remembers your cookie choice, keeps you logged in, holds your booking or basket | Always. The site does not work without them |
| Analytics | Google Analytics counts visits and shows which pages people use | Only if you accept analytics cookies |
| Marketing | We do not use marketing cookies at the moment. | Only if you accept marketing cookies |
Before you agree, no analytics or marketing cookies are set. Wix, which hosts the site, also sets some necessary cookies. The banner lists them under the same types.
The map on our contact page loads only when you tap "Show the map". Until then nothing is loaded from Google. Once you tap it, Google Maps loads, sets its own cookies and receives your IP address under Google's own privacy policy. When you tap "Get directions", Google Maps opens in a new tab in the same way.
7. Newsletter and course waitlists
Course waitlist. When you ask to join the waitlist for a course, we use your details only to tell you when dates for that course are published. Joining costs nothing and does not reserve a place.
Newsletter. You only get our newsletter if you ask for it. When you sign up we send you an email with a link to confirm. Nothing else is sent until you click it.
Every email we send has an Unsubscribe link. You can also email us and we will take you off the list. Unsubscribing does not affect any booking you have made. Our emails tell us whether they were opened and which links were clicked.
8. Who we share your information with
We do not sell your information. Some providers act only on our instructions under a data processing agreement: Wix, Google Analytics and Oplify. Others use your details under their own privacy policies: payment providers, Google Maps, Google and Facebook sign-in, our courier, our accountant and our email provider.
| Provider | What they do for us |
|---|---|
| Wix.com Ltd. | Hosts the website, member accounts, bookings, shop, forms and our emails to you |
| Oplify | Maintains the website and can access our Wix account to do that |
| Wix Payments | Takes card and wallet payments for deposits and shop orders |
| Google Ireland Limited | Google Analytics (only with your consent), Google Maps when you ask to see the map or open directions, Google sign-in if you use it |
| Meta Platforms Ireland Limited | Facebook sign-in, if you use it |
| Microsoft (Outlook) | Our email inbox, for messages you send us |
| An Post | Delivers shop orders |
| Our accountant | Prepares our accounts |
We may also share information when the law requires it, for example with Revenue.
9. Information sent outside Ireland
Some of these providers store data outside the European Economic Area, for example Wix in Israel and the United States, and Google, Meta and Microsoft in the United States. These transfers are protected by an EU adequacy decision (Israel, and US companies certified under the EU-US Data Privacy Framework) or by the European Commission's standard contractual clauses.
10. How we protect it
Your information is held in our Wix account, behind a password and two-step login. The website uses HTTPS. Only the people named in this policy can see health forms. If a breach puts your information at risk, we will report it to the Data Protection Commission within 72 hours and tell you if the risk to you is high.
11. Your rights
You can ask us to:
- give you a copy of the information we hold about you
- correct anything that is wrong
- delete your information
- restrict how we use it
- give you your information in a format you can take elsewhere
- stop using it where we rely on legitimate interest
- stop sending you marketing, at any time, with no reason needed
Where we rely on your consent, you can withdraw it at any time. That does not affect what we did before you withdrew it.
Email transformbymon@outlook.com to use any of these rights. We reply within one month, at no cost. We may ask you to confirm who you are first. Sometimes the law lets us keep information you ask us to delete, for example tax records. We will tell you if that applies.
We do not make decisions about you by automated means.
12. Complaints
If you are unhappy with how we handle your information, please tell us first and we will try to put it right. You can also complain to the Data Protection Commission:
Data Protection Commission
21 Fitzwilliam Square South, Dublin 2, D02 RD28
www.dataprotection.ie
13. Children
Our treatments and courses are for adults aged 18 and over. We do not knowingly collect information from anyone under 16 online.
14. Changes to this policy
When we change this policy we update the date at the top. If the change affects how we use information you have already given us, we will tell you by email.