Privacy Notice

1. Who is responsible for your information?

EyelashedL Studios is responsible for deciding how and why your personal information is used.

For questions, requests or concerns about your information, contact:

EyelashedL Studios
Enfield, London
eyelashedl15@outlook.com

2. Information we may collect

Depending on how you interact with us, we may collect:

• Your name, email address, telephone number and other contact details.
• Appointment, course, consultation, attendance and booking information.
• Payment status, transaction references, amounts paid and outstanding balances. Card details are handled by the payment provider and are not stored by us.
• Consultation forms, signed consent forms, allergies, health information, contraindications and other information needed to provide treatments or practical training safely.
• Course assessments, case studies, feedback, qualifications and certificate records.
• Messages, enquiries, complaints and other communications.
• Photographs of treatment or student work where appropriate.
• Technical information associated with use of the website, such as IP address, browser information and security logs.

3. Where we obtain information

We usually receive information directly from you when you contact us, book, pay, complete a form, attend an appointment or course, submit work or communicate with us.

We may also receive relevant booking or transaction information from providers used to arrange appointments, consultations and payments, including Stripe, Acuity Scheduling and Calendly.

If a student arranges a model, we may receive the model’s basic contact or attendance details from the student before collecting the remaining information directly from the model.

4. How and why we use information

Bookings, treatments and courses

We use contact, booking, payment, attendance and course information to respond to enquiries, take bookings, process payments, provide treatments and training, send joining information, manage models, assess students and issue certificates. We normally rely on the lawful basis of taking steps at your request and performing our contract with you.

Health and safety information

We use relevant health, allergy, contraindication and consent information to decide whether a treatment or practical activity can be carried out safely. Health information is special-category data. Where necessary, we rely on the lawful basis of performing our contract and on your explicit consent for the use of this health information. You may withdraw that consent, but we may then be unable to provide the treatment or practical activity safely.

Business administration and legal obligations

We use transaction, accounting and booking records to administer the business, maintain financial records, respond to legal claims and comply with tax, safety and other legal requirements. We rely on legal obligations and our legitimate interests in operating and protecting the business.

Customer service and security

We may use communications, booking records and technical information to answer questions, resolve complaints, prevent fraud, secure the website and protect our clients, students and business. We rely on our legitimate interests, provided those interests are not overridden by your rights.

Photographs and marketing

We will request separate permission before using an identifiable photograph of a client, student or model for social media, our portfolio or other marketing. This permission is optional and refusing it will not affect a treatment, course or assessment. You may withdraw permission for future use by emailing us.

5. When information is required

Some information is required so we can enter into or perform a booking contract, process payment, communicate essential joining information or provide a service safely. If required information is not provided, we may be unable to accept or complete a booking, treatment, model session or course assessment.

6. Who we share information with

We share only the information needed for the relevant purpose. Recipients may include:

• Stripe, for course payments and transaction processing.
• Acuity Scheduling, for treatment appointment bookings.
• Calendly, for course-consultation bookings.
• Resend and Microsoft Outlook, for transactional emails and communications.
• Website hosting, database, security and IT service providers.
• Accountants, insurers, legal advisers, regulators, courts or public authorities where reasonably necessary or legally required.

We do not sell personal information.

7. International transfers

Some service providers may store or process information outside the United Kingdom. Where this happens, we expect the provider to use a legally recognised transfer mechanism or other appropriate safeguards. You may contact us if you would like more information about a relevant provider or safeguard.

8. How long we keep information

We keep information only for as long as it is reasonably needed for the purpose for which it was collected, including to meet legal, insurance, accounting, safeguarding and dispute-resolution requirements.

• General enquiries that do not lead to a booking are normally kept for up to 12 months.
• Booking, payment and accounting records are normally kept for up to six years after the relevant transaction or the end of the relationship.
• Course attendance, assessment, case-study and certificate records are normally kept for up to six years after course completion.
• Consultation, consent and health-and-safety records are kept for the period reasonably required by our insurer, legal obligations and any applicable limitation period, and are reviewed regularly.
• Marketing photographs are kept until they are no longer needed or permission for future use is withdrawn, subject to material already lawfully published.

Information may be kept for longer where a complaint, legal claim, safeguarding issue or legal obligation requires it. When information is no longer needed, we delete it securely or anonymise it.

9. Security

We take reasonable organisational and technical steps to protect personal information against accidental loss, unauthorised access, alteration or disclosure. Access is limited to people and service providers who need the information for a legitimate purpose.

10. Your data-protection rights

Depending on the circumstances and lawful basis, you may have the right to:

• Ask for a copy of your personal information.
• Ask us to correct inaccurate or incomplete information.
• Ask us to delete information in certain circumstances.
• Ask us to restrict how information is used.
• Object to processing based on legitimate interests or to direct marketing.
• Ask for certain information in a portable format.
• Withdraw consent where we rely on consent.

These rights are not absolute and exemptions may apply. To make a request, email eyelashedl15@outlook.com. We may need to verify your identity before responding.

11. Children and young people

Course students may be aged 16 or 17. We may collect limited information about a parent or guardian where consent or communication is required. We aim to explain our use of information clearly and take particular care when handling information relating to a young person.

12. Automated decision-making

We do not use personal information to make solely automated decisions that have legal or similarly significant effects. Payment providers may carry out their own fraud-prevention and eligibility checks under their own privacy information.

13. Other websites and booking providers

Our website may link to external booking, payment and social-media services. Those services operate under their own privacy notices and cookie practices. We encourage you to read them before providing personal information.

14. Complaints

Please contact us first at eyelashedl15@outlook.com so we can try to resolve your concern.

You also have the right to complain to the Information Commissioner’s Office. Visit ico.org.uk/make-a-complaint or telephone 0303 123 1113.

15. Changes to this notice

We may update this notice when our services, providers or legal responsibilities change. The latest version will be published on this page with its updated date.