Privacy & Data Protection Policy

Bella Jules Beauty, Aesthetics and Training Ltd is committed to protecting the privacy, confidentiality and security of personal information. This policy explains how personal data is collected, processed, stored, shared and disposed of in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

Who this applies to

This policy applies to learners, prospective learners, staff, contractors, models, clients attending practical training sessions, visitors, suppliers and business contacts. It covers all personal data held in electronic or paper format.

Information we may collect

Contact details — name, address, telephone number, email address
Date of birth and emergency contact details
Course attendance, assessment and certification records
Treatment records, consent forms and medical declarations where applicable
Financial information relating to bookings and payments
Photographs, where consent has been given

Lawful basis for processing

We process personal data under one or more of the following lawful bases: contract (to deliver training and services), legal obligation (to meet legal and regulatory requirements), legitimate interests (academy administration and business operations) and consent (for example, marketing communications or use of photographs).

How we store and protect your data

Electronic records are held on password-protected systems and secure cloud storage with restricted access, anti-virus protection and regular backups. Paper records are kept in locked storage with restricted access and secure disposal procedures.

Sharing your information

Personal data is only shared where necessary and lawful — for example with accreditation bodies, awarding organisations, insurance providers, legal authorities or professional advisers. We will never sell your personal information to third parties.

Photography, video & marketing

We may request your consent to use photographs, videos, testimonials and training images for marketing materials, social media, our website and promotional activities. Consent may be withdrawn at any time.

How long we keep your data

Learner, assessment and certification records — 6 years
Complaints and appeals records — 3 years
Accident records — minimum 3 years
Staff records — 6 years after employment ends
Marketing consents — until consent is withdrawn

Your rights

Under UK GDPR you have the right to be informed, the right of access, the right to rectification, the right to erasure, the right to restrict processing, the right to data portability, the right to object, and rights relating to automated decision-making. To make a Subject Access Request, contact us in writing — we will normally respond within one calendar month.

Data breaches

Any actual or suspected data breach is reported immediately to the Academy Director. We will investigate, assess risk, take corrective action, notify the Information Commissioner's Office (ICO) where required, and inform affected individuals when necessary.

Cookies

This website uses essential cookies needed for it to function, and — only with your consent — analytics cookies that help us understand how the site is used. You can accept or decline analytics cookies using the banner shown on your first visit, and change your mind at any time by clearing your browser cookies.

Responsibility

As a small training provider we are not currently required to appoint a formal Data Protection Officer. Responsibility for data protection compliance rests with the Academy Director, Kimberley Hodson-Walker. This policy is reviewed annually or sooner if legislation, operations or ICO guidance change.

Questions about this policy? Contact Bella Jules Beauty, Aesthetics and Training Ltd, kim@bellajules.co.uk or 07778 963287.