Your records are stored in several ways:
On paper, in a locked filing cabinet, in a building which is locked, when not attended.
On my computer. This is password-protected, backed up regularly, and kept in a building which is locked when not attended.
We use Calendly to manage appointments, client communication about appointments and online booking. As such Calendly acts as a Data Processor on our behalf as defined under GDPR. The details of how Calendly undertake this can be found in the Calendly data processing addendum (https://calendly.com/
Should you subscribe to emails, we use Mailchimp to manage our email campaigns. As such Mailchimp acts as a Data Processor on our behalf as defined under GDPR. The details of how Mailchimp undertake this can be found in the Mailchimp Data Processing Addendum (https://mailchimp.com/legal/