Privacy Policy

Last Updated: 12/6/25

1. Privacy Policy Purpose and Aim

UK Beauty School is committed to protecting your personal information and respecting your privacy rights. We are the data controller for the personal information we collect about you.

We recognise the importance of protecting the privacy of personal information and complying with applicable data protection laws, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This Privacy Policy explains how we collect, use, store, and protect your personal information.

We aim for this Privacy Policy to provide transparency about how your information is obtained, used, and stored. This Policy may be updated periodically to reflect changes in our practices or legal requirements. We will notify you of any material changes and publish the updated policy on our website.

2. Definitions and Key Terms

2.1 Personal Data: Any information relating to an identified or identifiable individual, including but not limited to names, contact details, identification numbers, location data, and online identifiers.

2.2 Special Category Data: Personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, or data concerning a person’s sex life or sexual orientation.

2.3 Data Controller: UK Beauty School (My Learning Online Limited) as the entity that determines the purposes and means of processing personal data.

2.4 Data Processor: Third parties who process personal data on our behalf according to our instructions.

2.5 Processing: Any operation performed on personal data, including collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure, dissemination, restriction, erasure, or destruction.

3. Information We Collect

3.1 Personal Data We May Collect

We may collect and process the following personal data:

• Name and contact details (email address, phone number, postal address)
• Date of birth and age verification
• Gender
• Educational background and qualifications
• Employment history and current occupation
• Course preferences and learning progress
• Communication records (emails, phone calls, chat transcripts)
• Website usage data and analytics
• Marketing preferences

3.2 Financial Information (With Your Consent)

When you enrol in courses or payment plans, we may collect:

• Payment method details
• Billing information
• Bank account details (processed through secure third-party payment providers)
• Financial eligibility information for payment plans
• Transaction history
• Driver’s licence details (for identity verification with payment plan providers)

3.3 Technical Data

We automatically collect certain technical information when you use our website:

• IP address and device information
• Browser type and version
• Operating system
• Website navigation data
• Cookies and similar tracking technologies

3.4 Special Category Data

We do not routinely collect special category data. If we need to process such data for specific legitimate purposes (such as reasonable adjustments for disabilities), we will obtain your explicit consent and explain the specific purpose.

4. Legal Basis for Processing Your Data

We process your personal data based on the following legal grounds under UK GDPR Article 6:

4.1 Contract Performance: To provide our educational services, process enrollments, and fulfill our contractual obligations to you.

4.2 Legitimate Interests: For business administration, fraud prevention, direct marketing (for existing customers), website analytics, and improving our services.

4.3 Legal Compliance: To comply with regulatory requirements, tax obligations, and other legal duties.

4.4 Consent: For marketing communications to prospects, certain cookies, and any special category data processing.

4.5 Vital Interests: In rare circumstances where processing is necessary to protect someone’s life or physical safety.

5. How We Use Your Information

We use your personal data for the following purposes:

5.1 Service Delivery:

• Processing course applications and enrollments
• Delivering educational content and support
• Managing payment plans and financial arrangements
• Providing customer service and support
• Assessing eligibility and affordability for courses

5.2 Business Operations:

• Data analytics and service improvement
• Quality assurance and compliance monitoring
• Internal record keeping and administration
• Fraud prevention and security

5.3 Marketing and Communications:

• Sending course information and promotional materials (with consent for prospects, legitimate interests for existing customers)
• Personalising website content and recommendations
• Conducting market research and surveys

5.4 Legal and Regulatory:

• Complying with legal obligations
• Responding to legal requests and court orders
• Protecting our rights and interests

6. Cookies and Website Analytics

6.1 What Are Cookies

Cookies are small text files stored on your device when you visit our website. We use cookies to enhance your browsing experience, analyse website usage, and deliver relevant content.

6.2 Types of Cookies We Use

Essential Cookies: Necessary for website functionality, security, and your session management.

Performance Cookies: Help us understand how visitors interact with our website by collecting anonymous statistical information.

Functional Cookies: Remember your preferences and settings to improve your experience.

Marketing Cookies: Track your online activity to deliver relevant advertisements and measure campaign effectiveness.

6.3 Managing Cookies

You can control cookie settings through your browser preferences. However, disabling certain cookies may affect website functionality. Our cookie consent tool allows you to manage preferences for non-essential cookies.

6.4 Third-Party Analytics

We use Google Analytics and similar services to understand website usage. These services may use cookies and collect data according to their own privacy policies.

7. Sharing Your Information

7.1 When We Share Data

We may share your personal data with:

7.2 Third-Party Service Providers:

• Payment processors and financial service providers (for secure payment processing)
• Educational institutions and training providers (when you enroll in their courses)
• IT service providers and cloud hosting services
• Customer service and communication platforms
• Marketing and analytics service providers

7.3 Legal Requirements:

• Law enforcement agencies, regulators, or courts when legally required
• Professional advisors (lawyers, accountants, auditors)
• In connection with legal proceedings or regulatory investigations

7.4 Business Transfers:

• In the event of a merger, acquisition, or sale of our business assets

7.5 Data Processing Agreements

All third-party processors are bound by data processing agreements ensuring they handle your data securely and in accordance with UK GDPR requirements.

7.6 International Transfers

Some of our service providers may process data outside the UK/EEA. Where this occurs, we ensure adequate safeguards are in place, including:

• Adequacy decisions from the UK government
• Standard Contractual Clauses approved by UK authorities
• Certification schemes or codes of conduct

8. Your Rights Under Data Protection Law

You have the following rights regarding your personal data:

8.1 Right to Information

You have the right to receive clear information about how we process your data (provided in this policy).

8.2 Right of Access

You can request copies of the personal data we hold about you, along with information about how it’s being processed.

8.3 Right to Rectification

You can request correction of inaccurate or incomplete personal data.

8.4 Right to Erasure (‘Right to be Forgotten’)

You can request deletion of your personal data in certain circumstances, including:

• The data is no longer necessary for the original purpose
• You withdraw consent (where consent was the legal basis)
• The data has been unlawfully processed
• Legal obligation requires erasure

8.5 Right to Restrict Processing

You can request that we limit how we use your data in certain situations.

8.6 Right to Data Portability

You can request to receive your data in a structured, commonly used format, or have it transferred to another organisation.

8.7 Right to Object

You can object to processing based on legitimate interests, including direct marketing.

8.8 Rights Related to Automated Decision-Making

You have rights regarding solely automated decision-making and profiling that significantly affects you.

8.9 How to Exercise Your Rights

To exercise any of these rights:

• Email us at [email protected]
• Call us on 0800 102 6420
• Write to us at the address in Section 12

We will respond within one month of receiving your request. For complex requests, we may extend this by up to two months and will inform you of any delay.

9. Data Retention

9.1 Retention Periods

We retain personal data for different periods depending on the purpose:

• Student Records: 7 years after course completion (regulatory requirement)
• Financial Records: 7 years after last transaction (tax and legal requirements)
• Marketing Data: Until consent is withdrawn or 3 years of inactivity
• Website Analytics: 26 months maximum
• Communication Records: 3 years after last contact
• Employment-related Data: 6 years after end of relationship

9.2 Deletion Process

When retention periods expire, we securely delete or anonymise personal data unless legal obligations require longer retention.

10. Data Security and Protection

10.1 Security Measures

We implement appropriate technical and organisational measures to protect your personal data, including:

• Encryption of data in transit and at rest
• Access controls and authentication systems
• Regular security assessments and updates
• Staff training on data protection
• Secure data backup and recovery procedures

10.2 Data Breaches

In the unlikely event of a data breach that poses a high risk to your rights and freedoms, we will notify you within 72 hours of becoming aware of the breach, along with the relevant supervisory authority.

10.3 Staff Obligations

All employees and contractors with access to personal data are bound by confidentiality obligations and receive regular data protection training.

11. Children’s Privacy

We do not knowingly collect personal data from individuals under 16 years of age without appropriate parental or guardian consent. If you believe we have collected data from a child without proper consent, please contact us immediately, and we will take steps to remove the information.

12. Marketing Communications

12.1 Basis for Marketing

We may send marketing communications based on:

• Your explicit consent (for prospects and specific campaigns)
• Legitimate interests (for existing customers about similar services)
• Statutory exemptions for business-to-business communications

12.2 Opting Out

You can unsubscribe from marketing communications at any time by:

• Clicking the unsubscribe link in emails
• Replying ‘STOP’ to SMS messages
• Contacting us directly
• Updating your preferences in your account settings

13. Automated Decision-Making and Profiling

We may use automated systems to:

• Assess creditworthiness for payment plans (in conjunction with third-party providers)
• Personalise course recommendations
• Detect fraud and security threats

You have the right not to be subject to solely automated decision-making that significantly affects you. If we use such systems, we will inform you and provide an opportunity to request human intervention.

14. Third-Party Websites

Our website may contain links to third-party websites. This privacy policy only applies to our website and services. We are not responsible for the privacy practices of external websites and encourage you to read their privacy policies.

15. Changes to This Privacy Policy

We may update this privacy policy to reflect changes in our practices, services, or legal requirements. We will:

• Post the updated policy on our website
• Notify you of material changes via email or prominent website notice
• Update the “Last Updated” date at the top of this policy

16. Contact Information and Complaints

16.1 Contact Details

For any questions about this privacy policy or to exercise your rights:

Email: [email protected]
Phone: 0800 102 6420
Post: My Learning Online Limited (trading as UK Beauty School)
4th floor Imperial House, 8 Kean Street, London WC2B 4AS

16.2 Data Protection Officer

If we are required to appoint a Data Protection Officer, their contact details will be published here and on our website.

16.3 Complaints

If you have concerns about how we handle your personal data, you can:

1. Contact us directly using the details above
2. Lodge a complaint with the Information Commissioner’s Office (ICO):
   • Website: ico.org.uk
   • Phone: 0303 123 1113
   • Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

We are committed to resolving any privacy concerns promptly and fairly. All complaints will be acknowledged within 48 hours and investigated thoroughly in accordance with our customer service standards.