Privacy Policy

The Wax Lab Training Academy Limited (“we”, “our”, “us”) is committed to protecting the privacy and security of your personal information. This policy explains how we collect, use, store and protect your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

 

1. Who we are

 

The Wax Lab Training Academy Limited is a training provider offering education in waxing hair removal techniques. We are the data controller for the purposes of UK GDPR.

 

Contact details:

• Business name: The Wax Lab Training Academy Limited

• Email: hello@thewaxlab.co.uk

• Address: Ground Floor Rear, 14 Blandford Square, Newcastle upon Tyne, NE1 4HZ

 

 

2. What information we collect

 

We may collect and process the following personal information about you:

• Identity and contact details: name, address, email address, phone number.

• Education/training records: details of your enrolment, attendance, assessment results, and certification.

• Payment information: billing details and records of payments made.

• Sensitive data (special category): where relevant, health information you provide to us (e.g. allergies, medical conditions relevant to training).

 

 

 

3. How we use your information

 

We will only use your personal information where the law allows. Common uses include:

• To register you as a student.

• To provide training, support, and certification.

• To engage in communication with you including confirmation and reminders of course bookings, and requests to cancel or change bookings.

• To process payments and maintain accounts/records.

• To communicate with you about your course, our services, updates, or policies.

• To meet legal or regulatory obligations.

• To hold for insurance purposes.

 

MARKETING

We would like to send you information about products and services, which may be of interest to you.  We will ask for your consent to receive marketing information.

If you have consented to receiving marketing, you may opt out at a later date.

You have the right at any time to stop us from contacting you for marketing purposes or giving your information to third party suppliers of products or services.  If you no longer wish to be contacted for marketing purposes, please contact us.

 

4. Lawful basis for processing

 

We rely on the following lawful bases under UK GDPR:

• Contract – to provide you with training and related services.

• Legal obligation – to comply with applicable laws (e.g. accounting/tax rules).

• Legitimate interests – to manage and improve our business operations.

• Consent – where we process health information or send you marketing communications.

 

 

 

5. Where your information is stored

 

We store student information electronically using Google Drive, a secure cloud-based storage service. Google may store data on servers located within the United Kingdom, the European Economic Area (EEA), or in other countries outside the UK.

 

Where data is transferred outside the UK, Google ensures that appropriate safeguards are in place to protect your information, such as Standard Contractual Clauses approved by the UK Information Commissioner’s Office (ICO).

 

We have chosen Google as our cloud service provider because it complies with recognised security standards (including ISO 27001) and offers strong measures to protect personal data.

 

 

6. Data sharing

 

We do not sell or trade your personal information. We may share your data with:

• Our professional advisers (e.g. accountants).

• Awarding or accreditation bodies (if certification requires).

• Regulators or authorities where legally required.

• IT or cloud service providers (such as Google) who process data on our behalf.

 

 

7. How long we keep your information

 

We only keep your information for as long as necessary for the purposes set out in this policy. Generally:

• Student training records: 6 years after course completion

• Financial/payment records: 6 years, in line with HMRC requirements

• Health information: deleted once no longer necessary for training provision.

 

 

8. Your data protection rights

 

Under UK GDPR, you have the following rights:

• Access – to request a copy of the information we hold about you.

• Rectification – to correct inaccuracies.

• Erasure – to request deletion of your data.

• Restriction – to limit how we use your data.

• Portability – to request transfer of your data to another provider.

• Objection – to object to certain uses, including marketing.

• Withdraw consent – where consent is the lawful basis.

 

To exercise your rights, please contact us at hello@thewaxlab.co.uk.

 

 

9. Security

 

We use technical and organisational measures to keep your data secure, including password protection, access controls, and encrypted cloud storage through Google Drive.

 

 

10. Complaints

 

If you are unhappy with how we handle your data, please contact us first. You also have the right to complain to the Information Commissioner’s Office (ICO) at www.ico.org.uk.