Privacy Statement

The Hair and Beauty College Limited (“HBC”, “we”, “us”) is a beauty and aesthetics training college based at 78 Bridge Street, Warrington WA1 2RF. We’re registered with the Information Commissioner’s Office under registration number C1756707 and we take your privacy seriously.

This statement explains what personal data we collect, why we collect it, who we share it with, how long we keep it, and the rights you have over it under the UK GDPR and the Data Protection Act 2018.

Last updated: 2026-09-08 (v2 — reviewed and approved by Paula and our solicitor)

---

1. Who’s responsible for your data

The data controller is:

The Hair and Beauty College Limited 78 Bridge Street, Warrington WA1 2RF Company number 16387627 · ICO registration C1756707 Email: enrol@thehairandbeautycollege.co.uk Phone: 01925 747371

Where this statement uses “we” or “us”, we mean HBC as data controller.

---

2. What data we collect, and why

We collect the minimum data needed for each interaction. We don’t collect data “just in case” — every category below has a clear purpose.

2.1 Enquiries — Contact form, email, phone

What we collect	Why	Lawful basis
Name	To address you correctly when we reply	Pre-contract (UK GDPR Art. 6(1)(b))
Email	To respond to your enquiry	Pre-contract
Phone (optional)	To respond to your enquiry by phone if you prefer	Pre-contract
Course of interest	To route your enquiry to the right person	Pre-contract
Your message	To answer your question	Pre-contract
Type of enquiry	To route to `info@` or `enrol@`	Legitimate interest (efficient inbox routing)

2.2 Enrolment — funded courses (VTCT diplomas via Advanced Learner Loan)

What we collect	Why	Lawful basis
Full name, date of birth, postcode	To produce your Funding Information Letter (a GOV.UK requirement)	Legal obligation (UK GDPR Art. 6(1)(c))
Email, phone	To stay in touch through your application	Contract
Course of interest, preferred start date	To match you to a cohort	Contract
Anything-we-should-know note	To support you appropriately on the course	Contract / consent for special-category data (see 2.6)

2.3 Enrolment — paid courses (CPD and non-funded Awards)

Same as 2.2 (minus DOB and postcode), plus:

What we collect	Why	Lawful basis
Payment preference	To send the right payment link	Contract
Payment details	We don’t store these — Stripe and Payl8r handle them directly	N/A — handled by payment processors

2.4 Treatments at our salon floor (public clients)

What we collect	Why	Lawful basis
Name, contact details	To book and confirm your appointment	Contract
Treatment history, contraindications, allergies	To deliver the treatment safely	Contract + explicit consent for special-category data (Art. 9(2)(a))

2.5 Model Group sign-up

See `/model-group` for full detail. We collect contact details, treatment preferences, days available, photo/video consent level, and an optional medical history field.

Lawful basis
Consent (Art. 6(1)(a)) for the contact list itself
Explicit consent (Art. 9(2)(a)) for any medical history you choose to disclose
Consent for any photos or video — opt-in only, re-confirmed per session

2.6 Health and learning-difference disclosures (students)

If you tell us about a medical condition, allergy, medication, or learning difference at enrolment, that’s special-category data under UK GDPR Article 9. We hold it on the basis of:

• Explicit consent (you’ve chosen to disclose so we can adapt training to support you); or where consent isn’t appropriate,
• Substantial public interest under the Equality Act 2010 (we’re obliged to make reasonable adjustments).

This data is shared only with your tutor, on a need-to-know basis, and is held for the same retention period as the rest of your learner record.

2.7 Coursework, portfolios, assessments

While you’re enrolled, we collect work-product data: written assessments, practical observation records, portfolio submissions, attendance, and assessment outcomes. We hold this on the basis of contract (delivering the course you’ve enrolled on) and, where awarding-body audit requires, legal obligation.

2.8 Site analytics and marketing pixels

See our Cookie Policy for the full breakdown. In summary:

• Essential cookies load by default (needed for the site to function and for the Jotform anti-spam check)
• Analytics and marketing tools load only after you consent via our cookie banner

The tools we use, when consented:

Tool	Purpose	Vendor
Google Analytics 4 (GA4)	Aggregate site usage statistics — pages visited, time on site, conversion paths	Google Ireland Limited
Google Tag Manager	Container for the analytics + marketing tags so they can be managed without code changes	Google Ireland Limited
Google Ads conversion tracking (if used)	Measure which ads lead to enrolments so we don’t waste your council-tax-funded loan budget on ads that don’t work	Google Ireland Limited
Meta Pixel (possibly — see consent banner)	If we run Facebook or Instagram ads, the pixel measures whether those ads convert. Toggleable in the cookie banner.	Meta Platforms Ireland Limited

If you decline analytics/marketing cookies, we still serve the site — you just don’t appear in our usage stats and any Meta-driven retargeting doesn’t see you.

---

3. Who we share your data with

We never sell your data. We share it only with the third parties below, only for the purposes named, and only where the lawful basis above permits.

3.1 Course delivery and assessment

Recipient	What we share	Why
VTCT (awarding body)	Learner registration data, assessment outcomes, certification details	Statutory awarding-body audit + certificate issuance
Focus Awards (awarding body)	Same — for Focus-awarded qualifications	Same
The CPD Group (awarding body)	Same — for CPD-accredited courses	Same
Tutors and assessors (internal)	Your enrolment data + any health disclosures	To deliver and assess the course

3.2 Funded course administration

Recipient	What we share	Why
Funding compliance partner (named at point of enrolment)	Your name, contact details, course of interest, start date	To guide you through your loan application — we hand off after your enquiry
Student Loans Company (statutory)	Course confirmation, fee verification, attendance evidence	Statutory funding administration

3.3 Payment processing

Recipient	What we share	Why
Stripe (payment processor)	Card data is collected by Stripe directly — HBC never sees or stores card numbers	Card / Apple Pay / Google Pay / Bank transfer / PayPal / Clearpay processing
Social Money Ltd t/a Payl8r (consumer credit)	Your name, contact details, course fee, and information needed for credit assessment if you apply	Finance application processing — see `/funding/payl8r` for full disclosure

HBC is an Introducer Appointed Representative of Social Money Ltd t/a Payl8r (FCA Reference 675283). Representative APR 65.5%.

3.4 Site infrastructure and tools

Recipient	What we share	Purpose	Data residency
Jotform (form intake)	Whatever you enter into our forms	Form processing and notification routing	EU (Frankfurt)
Google Analytics 4 (consent-gated)	Pseudonymous usage events, page views, IP truncated	Aggregate site analytics	EU + US
Google Tag Manager (loads on consent)	Tag-management container; doesn’t itself collect data	Tag deployment	EU + US
Meta Pixel (consent-gated, possibly deployed)	Pseudonymous browsing events on the HBC site	Ad-conversion measurement on Facebook/Instagram	EU + US
WP Engine (site hosting)	Web traffic, IP addresses	Site hosting and DDoS protection	EU
Google Workspace (mailbox + business apps)	Email correspondence, calendar entries, document storage	Email infrastructure and internal admin	EU + US
Mailchimp (marketing email)	Name, email, marketing engagement events	Newsletter and course-update sends	EU + US

3.5 Statutory and regulatory

We share data with HMRC, Companies House, and the Information Commissioner’s Office where law requires it — this includes tax and accounting records, statutory company filings, and responses to lawful requests from the police, courts, or other regulators where we have a legal duty to disclose.

---

4. Children and under-18s

Most of our courses are 16+ (and funded courses require you to be 19+ at start under Advanced Learner Loan rules). Where someone under 18 enrols or signs up to the model group:

• A parent or guardian must be present at sign-up and on premises during attendance
• We collect parental consent for processing personal data of anyone under 13 (though our minimum age is higher than that)
• We do not direct any marketing at children

---

5. How long we keep your data

We keep data only as long as we need it for the purpose collected, and longer where law or awarding-body rules require.

Data category	Retention period	Reason
Enquiry records (form submission, not enrolled)	12 months from last contact	Operational follow-up; deleted thereafter
Learner records (enrolment, attendance, assessments, certification)	6 years from course completion or withdrawal	Awarding-body audit + statutory record-keeping (confirmed with VTCT/Focus).
Financial records (invoices, payment receipts)	6 years from end of relevant tax year	Companies Act 2006 + HMRC retention rules
Treatment client records (salon floor)	6 years from last treatment	Insurance and consumer-protection norms
Model group records	Until withdrawn or 24 months of inactivity (no response to slot offers)	Contract / consent — see Model Group sign-up
Marketing consents	Until withdrawn	Consent (Art. 6(1)(a))
Health and learning-difference disclosures	Same as the underlying learner / model record	Cannot be retained beyond the purpose of collection
Photos and video (with consent)	Until consent withdrawn or relevant student’s record reaches end of retention	Consent — see consent form per session
Google Analytics 4 data	14 months (default, configurable)	Legitimate interest for aggregated site analytics; consent for any user-level data
Meta Pixel data (if deployed)	180 days (Meta’s default custom-audience window)	Consent — toggleable in cookie banner

When a retention period ends, we delete or anonymise data through scheduled clean-up — not “as we get round to it”. Anonymised data may be retained for statistical reporting (e.g. cohort outcomes) without time limit, since it can no longer identify any individual.

---

6. Direct marketing

If you’ve opted in to receive marketing from HBC (course updates, open days, model-group slots that might suit you) we contact you through email — sent via Mailchimp (see Section 3.4).

You can withdraw consent at any time:

• Click unsubscribe at the bottom of any marketing email (handled by Mailchimp — instant)
• Email enrol@thehairandbeautycollege.co.uk with “UNSUBSCRIBE” in the subject
• Tell us by phone or in person

Withdrawing marketing consent doesn’t affect our right to contact you about an active enrolment or appointment — that’s covered by contract, not consent.

---

7. Your rights as a UK resident

Under UK GDPR you have the following rights over your personal data:

Right	What it means
Access	We give you a copy of the data we hold about you
Rectification	We correct inaccurate data on your request
Erasure (“right to be forgotten”)	We delete your data, subject to legal-retention exceptions
Restriction of processing	We pause certain uses of your data while a dispute is resolved
Portability	We provide your data in a structured, machine-readable format
Objection	You can object to processing based on legitimate interest or for direct marketing
Automated decisions	You’re not subject to decisions made solely by algorithm — we don’t use automated decisioning
Withdraw consent	Where processing is based on consent, you can withdraw at any time
Complain to the ICO	If you believe we’ve mishandled your data — see Section 9

Exercising your rights

To make a request, email enrol@thehairandbeautycollege.co.uk with the right you’re exercising in the subject line (e.g. “Subject Access Request”). We respond within 30 calendar days (extendable to 90 days for complex requests, with notice to you). Requests are free unless they are manifestly unfounded or excessive, in which case we’ll explain any fee before charging.

We may need to verify your identity before disclosing personal data — typically by asking for confirmation from the email address on file.

---

8. Where your data is processed

Our primary data processing happens in the United Kingdom (HBC office at 78 Bridge Street) and the European Union (Jotform Frankfurt data residency).

Some processors (Stripe, Payl8r) may transfer data to the United States for fraud-prevention checks. Where data leaves the UK / EU, we rely on:

• UK adequacy regulations (EEA, EU-approved adequacy decisions); or
• Standard Contractual Clauses (UK SCCs / EU SCCs) — the contractual safeguards approved by the ICO; or
• Specific consent where neither of the above applies.

---

9. Third-party websites

This site links to third parties (GOV.UK for the loan application, awarding-body sites, Google Maps, social media). Once you click through, you’re on their site and subject to their privacy policies — not ours. We don’t control how they handle your data and aren’t responsible for their practices.

---

10. How to complain

If you think we’ve mishandled your data, we’d like the chance to put it right first. Email enrol@thehairandbeautycollege.co.uk with “Data complaint” in the subject. We’ll acknowledge within 5 working days and respond fully within 30 calendar days.

If our response doesn’t satisfy you, you have the right to complain to the Information Commissioner’s Office:

• Online: ico.org.uk/make-a-complaint
• Phone: 0303 123 1113
• Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

You can complain to the ICO directly without going through us first — but we’d appreciate the chance to fix it.

---

11. Security

We use industry-standard technical and organisational measures to protect your data:

• Encryption in transit (HTTPS / TLS for all web traffic and form submissions)
• Encryption at rest (passwords hashed; sensitive data fields encrypted in the form provider’s database)
• Access controls (only authorised tutors and admin staff access learner records)
• Audit trails (form submissions and access logs retained per the table in Section 5)
• Secure deletion (scheduled erasure when retention periods end)
• Staff training on data protection and safeguarding

No system is 100% secure. If we ever experience a personal data breach that puts your rights at high risk, we’ll notify the ICO within 72 hours and you, where required, without undue delay.

---

12. Changes to this statement

We update this statement when our processing changes — for example, when we add a new tool, add a new processor, or extend a retention period. Material changes are notified to existing students and active enquirers by email.

The current version always lives at this URL with the Last updated date at the top.

---

13. Questions

If anything here is unclear:

• Email enrol@thehairandbeautycollege.co.uk
• Call 01925 747371 (Mon–Fri 9:30am–9:30pm, Sat 9:30am–4:30pm, Sun closed)
• Write to: The Hair and Beauty College Limited, 78 Bridge Street, Warrington WA1 2RF

---

The Hair and Beauty College · 78 Bridge Street, Warrington WA1 2RF · 01925 747371 · ICO registration C1756707

---