Luxe Beauty Training Academy is the data controller for the personal data described in this policy. You can reach us about any privacy matter at hello@luxebeautytrainingacademy.co.uk.

• Enquiry details — your name, email address, phone number (if given), the course you are interested in and your message.
• Order details — your name, academy name, email address, the manuals purchased and the payment reference returned by our payment provider.
• Technical data — basic information such as pages visited, gathered only where you have accepted analytics cookies.

We do not collect card numbers. Payments are handled by our payment provider on their own secure systems.

• To answer your enquiry and provide the course or manual you asked for — contract and legitimate interests.
• To issue certificates and keep training records — contract and legal obligation.
• To keep accounting and tax records — legal obligation.
• To send marketing emails, where you have opted in — consent, withdrawable at any time.
• To understand how the site is used — consent, via our cookie banner.

We share data only with the parties who help us run the academy:

• Service providers and subprocessors — our hosting, database, storage and email providers, who process data on our instructions under contract.
• Paddle.com — our Merchant of Record. Paddle handles the sale, payment processing, subscription management, invoicing, tax compliance and refunds for our products, and acts as an independent controller for that purpose. See Paddle's privacy notice.
• Professional advisers — our accountants and, where needed, legal advisers.
• Authorities — where we are required to disclose data by law.

We do not sell your data.

Enquiries are kept for up to two years. Order and certification records are kept for six years to meet UK accounting and accreditation requirements. Marketing consents are kept until you withdraw them.

Some of our providers process data outside the UK. Where that happens we rely on appropriate safeguards such as UK adequacy regulations or the International Data Transfer Addendum.

You have the right to access, correct, delete or restrict the use of your personal data, to object to processing based on legitimate interests, to withdraw consent, and to data portability. To exercise any of these, email us and we will respond within one month. You can also complain to the Information Commissioner's Office (ico.org.uk).

Details of the cookies we use, and how to change your choice, are in our cookie policy.

Access to enquiry and order data is restricted, transmitted over encrypted connections and protected by row-level database security rules. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your information.