Privacy notice

Who we are

The Cottage Training Centre, 7 Warsash Rd, Warsash, Southampton SO31 9HW. traininginbeauty@outlook.com.

We decide what happens to the information on this page, which makes us what the law calls the data controller for it. If you want to ask us anything about it, ring that number or send us a message - it comes to Lisa, and there is no separate department to be passed to.

We are small enough not to need a data protection officer, and we do not have one.

What we collect, and why

When you send us a message or ask about a course, we keep your name, your email address and what you wrote, so that we can answer you. If you asked about a particular course, treatment or date, that is kept with it.
When you ask a therapist for an appointment, we keep your name, email address, phone number if you gave it, what you asked for and when suits you, and we send them to the therapist you chose - see "Who else sees it".
When you sign in, your name and email address come from whichever account you used to sign in - Google, Apple or Microsoft. We never see or store a password.
When you book a place, we keep your name, email address and phone number, which course and date you booked, anything you told us, and whether the place is confirmed or on the waiting list. After the course we record whether you came, because that is what a register is and it is what your certificate rests on.
What you owe and what you have paid. We keep what you bought, the price and the VAT at the time, and every payment: how much, when, how it reached us - cash, bank transfer, the card machine, or a card paid on this website - and which of us took it. These are our accounting records as much as yours.
Card payments, which we deliberately do not see. Paying by card on this site takes you to Square, the card processor the centre already uses. Your card number is typed on their page, not ours, and it never reaches our website or our database. What comes back to us is that a payment of a certain amount succeeded and a reference for it, which is what we need to know your place is paid for and what our accountant needs at the year end. We could not tell you your own card number if you asked.
Your health, if you tell us - and only with your permission. Some treatments and products, including the chemicals we train with, aren't safe with certain medical conditions, allergies or medication, so when you book a course we ask. It's up to you: you can leave it and tell us on the day instead. If you do tell us, we keep it only if you tick the box saying we may, and we record when you agreed and to what wording. Only the centre can see it - it is never emailed, never used for anything else, and never shared. It is deleted 24 months after you told us, unless you confirm it again, and you can withdraw your permission at any time from your account or by asking us, and it is deleted there and then.
About you, for your certificate. When you book a course we ask your address, date of birth and nationality, and - if you want to tell us - your occupation, your VTCT registration number and the qualifications you already hold. Your certificate rests on them, and a VTCT qualification needs them to register you (see "Who else sees it"). You can see and change them on your account.
Which terms you agreed to. When you book, we record that you accepted our terms and conditions, which version of them, and when - so we both know what was agreed.
Who to ring in an emergency. When you book a course we ask for somebody we can ring if something happens to you while you're with us - their name and phone number. Please check they're happy for you to give it. You can change or remove it from your account.
Qualifications you tell us you hold. Some courses need one first. If you say you have it, we write down that you told us - not that we checked. We still ask to see the certificate on the day.
Notes of when we have spoken to you. If we ring you - to say a date has moved, or about a balance - we keep a note that we did, when, and a line about what was said, so nobody rings you twice about the same thing and nobody forgets to ring you at all.

Why we are allowed to hold it

The law asks us to say not just what we keep but what entitles us to keep it. In plain terms:

To do what you asked us to do. Answering your enquiry, holding your place, taking your money, teaching you and putting you on the register. You came to us for a course and this is the course happening. (Lawfully: performance of a contract with you, or steps you asked for before one.)
Because we have to. Money records, and - if you are taking a VTCT qualification - whatever VTCT requires us to keep so it stands up. (Legal obligation.)
To keep you safe. Your emergency contact, so we can reach somebody if you are taken ill or hurt on a course. (Legitimate interests - yours and ours - and, if it ever came to it, protecting somebody's vital interests.)
To run the place properly. Notes of when we have spoken to you, so nobody rings you twice or forgets to ring you at all; and keeping the website working and secure, which includes a report to our website statistics when a page goes wrong for you - whatever you chose about cookies, because it is how we find out and fix it. (Legitimate interests - ours in running a training centre somebody can rely on, and yours in not being rung twice about a cancelled course. If you think we have the balance wrong, say so and we will look at it.)
Because you gave your explicit permission, for your health. The law treats health information as a special kind and lets us keep it only with your clear, separate agreement - which is why it has its own box and is never ticked for you. (Explicit consent, UK GDPR Article 9(2)(a).)
Because you said yes. Anything beyond the cookies the site needs to work at all. You can take that back at any time, through "Manage cookies" in the footer, and taking it back does not affect anything we did while you had said yes.

People you book for

If you book a place for somebody else, or buy a gift voucher for them, we keep the name and email address you give us for them, and any message you write on the voucher. We use it for that booking or that voucher and nothing else.

Please make sure they are happy for you to give us their details. We have no way of asking them ourselves, and they have not visited this site.

If you booked on our previous website

This website replaced our previous one. If you booked with us there, we brought across your bookings, what you paid, whether you joined our mailing list, and the details and emergency contact you gave on its booking form, so your history and any course still to come are here. We did not bring across any health information you gave there, or accounts and passwords - you sign in here afresh. It is kept and used exactly as everything else in this notice is.

Cookies

The site needs a small number to work at all - staying signed in, keeping your basket and the booking you have just made, and remembering your cookie choices. Anything beyond that is off unless you say yes, and you can change your mind at any time through the "Manage cookies" link in the footer.

Who else sees it

Apart from the few named below, nobody sees your information for their own purposes.

The company that built and runs this website for us, under a written agreement that lets them use your information only to run it, keep it secure, and do what we ask. They use a small number of services to do that, each under the same kind of agreement:

the servers the website and its database run on, in London;
a service that sends the website's emails, in London;
a network that carries the connection between your browser and the website and protects it from attack - your connection passes through it, wherever in the world is nearest, but it keeps nothing;
website statistics, which tell us how the site is used without advertising cookies, and receive a report when a page goes wrong for you (which page, what went wrong, and your account if you are signed in), in the European Union.

Backups are kept, encrypted, on their own equipment in the UK.

The therapist you ask for an appointment. The therapists who work at the centre are independent - they run their own businesses and keep their own diaries. When you ask one of them for an appointment, what you sent goes to them by email so they can arrange it with you, and from then on they look after it as their own client record. We send it to the one you chose and nobody else.

Square, if you pay by card. They take the payment and they get your card details, your name and your email address in order to do it - directly from you, on their own page. They also use what they see to spot fraud, which is their own legal duty rather than something we ask for, so for that part they answer for themselves rather than to us. Square hold data outside the UK; their own terms and safeguards cover that, and they publish both.

VTCT, and only if you are taking a VTCT qualification. VTCT is the awarding body that issues VTCT qualifications, and to do that they need to know who you are. So when we register you with them for your qualification - not when you book, and not before - we send them the details they ask for to register you and issue your certificate. That is the only time anything about you leaves us for anyone else's purposes. If you are not taking a VTCT qualification, VTCT receive nothing about you.

Somebody checking your certificate. Every certificate we issue has a number on it. Anyone you give it to - an employer, an insurer - can check it on this website with that number and your surname, and they're shown only what's printed on it (your name, the course and the date) and whether it still stands. Without both, they're shown nothing, so nobody can look you up. We do it because a certificate that can't be checked is worth less to you.

Nobody else. Our courses accredited by ABT, and the certificates we issue ourselves, involve sending your details to nobody: ABT receive nothing about you.

What we do not do

We do not sell your information, we do not share it with anyone for their own marketing, and we do not send you anything you did not ask for.

How long we keep it

This list is read from the system that does the deleting, so it says what actually happens. All of it happens on its own: nobody has to remember to do it.

Contact-form enquiries, from when they were sent: deleted after 2 years.
Emailed sign-in links and sign-in sessions, from when they expire: deleted after 1 day.
Our record of what was done on the site - who changed what, and when: anonymised after 90 days (we keep what kind of thing happened and when - not who, or the details).
Health information, from when it was given or last confirmed: deleted after 24 months.
Emergency contacts, from the end of the learner's last course: deleted after 12 months.
Treatment requests, from when they were sent: deleted after 2 years.
The record of somebody who never booked - an enquiry, a sign-in, or details taken on the phone - from when we last heard from them: deleted after 36 months.
A learner's record - their places, bookings, details and our notes - from the end of their last course, or when we last heard from them if that's later - except money records and certificates, which are kept longer: deleted after 7 years.
Written assessments - the questions as asked, the answers, the marks and feedback, and any photos or scans - from the outcome of the qualification they were evidence for, or, where there's never one, from the end of the course or the place being cancelled: deleted after 6 years.

Some things are kept longer, or on their own terms:

Money records are kept for six years after the end of the tax year they fall in, because HMRC requires it. That one is not our choice and we cannot delete them sooner - so when your record is deleted, your name and email address stay on those bookings until six years after the end of the tax year of the last payment or refund on each.
Certificates. The name and number on a certificate we issued stay, so that anyone you show it to can still check it. If you want one withdrawn, ask us.

Your rights

All of these are free, and we will answer within a month. Email traininginbeauty@outlook.com or send us a message.

See it. Ask for a copy of what we hold about you.
Correct it. If something is wrong, tell us and we will fix it.
Delete it. Ask us to get rid of it. We delete everything we can straight away, and tell you what we have to keep and until when - a booking for a course you haven't done yet, money still owed, and our money records.

While a course is still to come or money is still owed, we also keep your sign-in and phone numbers, so we can reach you about it.

If you have an account you can close it yourself instead. It closes after 14 days, and then the same happens - except that your sign-in and phone numbers always go.
Pause it. Ask us to stop using it while something is in dispute, rather than deleting it.
Take it elsewhere. Ask for the information you gave us in a form you can hand to somebody else.
Object. Tell us to stop, where we are relying on "running the place properly" above. If it is about marketing, we stop, full stop, no argument.
Change your mind. Withdraw consent for anything you said yes to - including your health information, which you can delete yourself from your account.

Where the law makes us keep something we will say so rather than quietly doing nothing - the money records above are the usual case, and we cannot delete those early however much we would like to help.

Nothing here is decided by a computer. No automated system decides whether you get a place, what you pay, or whether you passed. A person does, every time.

If you are not happy

Tell us first - most things are a misunderstanding and we would rather fix it than have you complain about us.

If we cannot put it right, you can complain to the Information Commissioner's Office, which is the UK regulator for this. ico.org.uk/make-a-complaint or 0303 123 1113. You do not need our permission and it costs nothing.

Changes to this notice

If we change what we do with your information we will change this page and put the date on it. Where the change is a significant one, we will tell the people it affects rather than relying on them to re-read a web page.