Privacy/GDPR Policy

Effective Date:  11/03/2026

The Norwich School of Hair & Beauty (“we”, “our” or “us”) is committed to protecting and respecting your privacy in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This policy explains what personal information we collect, how we use it, and what rights you have.

1. Data Controller

The Norwich School of Hair & Beauty is the data controller for the personal information we collect.

If you have any questions or concerns, please contact us:

Email: team@nshb.uk

Post: Sapphire House, Roundtree Way, Norwich, NR7 8SQ

Phone: 01603 928900

2. Personal Information We Collect

We may collect the following categories of personal information when you enquire, apply, enrol, or use our services:

• Name, home address, email address, phone number
  
  
• Date of birth, emergency contact details
  
  
• IP address
  
  
• Photograph, enrolment number
  
  
• Special educational needs and/or medical health information (only when relevant and necessary)
  
  
• Payment details (processed securely via third parties – we do not store full card details)

Children’s Data

Where students are under the age of 18, personal information may be collected and processed with the consent of a parent or legal guardian where required. We take additional care to protect the privacy and safety of young people and process such information only where necessary for educational, safeguarding, or legal purposes.

3. Legal Basis for Processing

We process your personal data under the following lawful bases:

• Contractual necessity – to provide education and training services you have enrolled for.
  
  
• Legal obligation – to meet regulatory or statutory requirements.
  
  
• Consent – for marketing communications or where we ask for your explicit agreement (e.g. processing health information for patch tests).
  
  
• Legitimate interests – to manage our operations, improve our services, and ensure student safety.

4. How We Use Your Information

We use your personal data to:

• Process applications and enrolments.
  
  
• Deliver training and support services.
  
  
• Register students with awarding bodies.
  
  
• Process payments and issue invoices.
  
  
• Communicate with students and their contacts.
  
  
• Ensure health, safety, and safeguarding.
  
  
• Share important updates and marketing (only where you have not opted out).

5. Sharing Your Information

We do not sell, rent, or lease your data to third parties. However, we may share it with trusted service providers necessary to deliver our services, including:

• ITEC/VTCT – registering students with the awarding body for qualifications.
  
  
• Payment gateway providers used through WooCommerce (such as Stripe or similar secure payment processors).
  
  
• FreeAgent – invoicing software (stores your name and email/payee’s email).
  
  
• Slack – communication app used by all students and tutors.

 Data Processors

Some third-party providers process personal data on our behalf. These organisations act as “data processors” under UK GDPR and are contractually required to protect and process personal data only in accordance with our instructions and applicable data protection laws.

If any of these providers transfer data outside the UK/EEA, appropriate safeguards (such as Standard Contractual Clauses) are in place.

6. How Long We Keep Your Information

We keep personal information only for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting, or reporting requirements.

• Student records: retained for 3 years after enrolment ends.
  
  
• Financial/payment records: retained for 6 years minimum in line with HMRC requirements.
  
  
• Marketing contacts: retained until you opt out or withdraw consent.
  

7. Your Rights

Under UK GDPR, you have the following rights:

• Access – request a copy of your personal data.
  
  
• Rectification – request correction of inaccurate or incomplete data.
  
  
• Erasure (“Right to be forgotten”) – request deletion of your data.
  
  
• Restriction – request we limit how your data is processed.
  
  
• Portability – request transfer of your data to another provider.
  
  
• Objection – object to processing (e.g., for marketing).
  
  
• Withdraw consent – where processing is based on consent, you may withdraw it at any time.
  
  

To exercise these rights, please contact us using the details in Section 1.

8. Complaints

If you are unhappy with how we handle your personal data, please contact us first so we can resolve your concerns.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO):
www.ico.org.uk | Tel: 0303 123 1113

9. Security

We implement appropriate technical and organisational measures to protect your personal data against loss, misuse, unauthorised access, disclosure, alteration, or destruction. Access to personal data is restricted to authorised staff and service providers who require it for legitimate business purposes.

10. Cookies and Website Data

Our website may use cookies or similar technologies. For more details, please see our Cookie Policy.

11. Updates to This Policy

We may update this policy from time to time. The latest version will always be available on our website www.nshb.uk

Last updated: 11th March 2026