Skintastic Academy: Privacy Policy. Last updated 30 October 2026. This policy explains how Skintastic Aesthetic Lasers Ltd looks after your personal data when you visit our website, buy or study a course, or contact us.
1. Who we are
Skintastic Aesthetic Lasers Ltd (company number 15949505), trading as Skintastic Academy, registered office 26 The Avenue, Southampton, SO17 1XL, is the controller of your personal data. Contact us at info@skintasticaesthetics.com or on WhatsApp on +44 7432 485017 for anything about your data or this policy.
2. What we collect
- Identity and contact details: your name, email address, phone number, billing address and, for the qualifications that need it, your date of birth.
- Order and payment details: what you bought, the amount, the payment method and the order date. Your card or bank details are taken by our payment providers and we never see or store them.
- Account and learning records: your login details, course progress, quiz and assessment results, certificates, your signed agreement and the record of when and how you signed it (typed name, date, time, IP address and the version of our documents).
- Entry requirement evidence: copies of qualifications or certificates you send us to show you meet the entry requirements.
- Health information: details you give us for a Practical Day about health conditions, medication, allergies, pregnancy or skin conditions. This is special category data.
- Messages and enquiries: emails, WhatsApp messages and form submissions you send us.
- Photographs and video: images taken at Practical Days, if you agree to this.
- Technical data: your IP address, browser type, device, pages visited and cookie information (see section 8).
We get this information from you, from your employer or whoever pays for your course, from our payment providers, and from the technology we use to run the website.
3. Why we use it and our lawful basis
| What we do | Lawful basis |
|---|---|
| Process your order, give you access to the course, run Practical Days, assess you and issue your certificate | Contract |
| Take payment, keep accounting records, deal with tax and legal obligations | Contract and legal obligation |
| Keep a record of your agreement to our terms and declaration, and deal with claims and complaints | Legitimate interests (to protect ourselves and you) and legal claims |
| Share your completion details with The CPD Group, awarding organisations and similar bodies so your credits or qualification can be recorded | Contract and legitimate interests |
| Use your health information to keep you, models and others safe on a Practical Day | Your explicit consent, and to protect vital interests; special category data is used only for this |
| Keep the website secure, prevent spam and fraud, and understand how the website is used | Legitimate interests |
| Send you course news and offers by email or message | Your consent (you can withdraw it at any time). We may also email existing students about similar courses where the law allows, and you can opt out at any time |
| Use photographs or video that identify you for publicity | Your consent |
| Advertising and measurement cookies and pixels | Your consent where the law requires it (see section 8) |
4. Who we share it with
We share personal data only where we need to, with:
- Payment providers: WooPayments (Automattic, using Stripe), PayPal, and, if you choose them, Klarna and Clearpay, plus Apple Pay and Google Pay. They act as independent controllers for fraud checks and payment compliance.
- Accreditation and awarding bodies: The CPD Group, and for regulated qualifications the awarding organisation named on the course page.
- Technology suppliers acting for us: our website hosting provider, our email and messaging services, our learning management system, our anti-spam, security and form services (including Google reCAPTCHA) and our backup providers.
- AI feedback on written answers: Anthropic, the company behind the Claude AI service. When you submit a written answer on a course, we send the question and your typed answer, without your name or email address, so that feedback can be written and emailed to you. Your trainer reviews answers that need more work. Please do not include other people’s personal details in your written answers.
- Professional advisers and authorities: accountants, lawyers, insurers, and regulators or the police where the law requires.
- Advertising platforms: if you accept marketing cookies, Meta may receive information about your visit to help us measure and target adverts.
We do not sell your personal data. If a supplier is outside the UK, we make sure the transfer is protected, for example by the UK-US data bridge, UK adequacy decisions, or the UK International Data Transfer Agreement or Addendum.
5. How long we keep it
- Order, payment and accounting records: 6 years after the end of the tax year, as the law requires.
- Course, assessment and certificate records and your signed agreement: 6 years after you complete or leave the course, so that we can verify your certificate, support accreditation audits and deal with claims. We may keep a minimal record that a certificate was issued for longer.
- Health information from a Practical Day: up to 12 months after the day, unless an incident or claim means we need to keep it longer.
- Enquiries that do not lead to a booking: up to 12 months.
- Marketing preferences: until you opt out.
- Photographs and video: for as long as you consent, or until the image is no longer in use.
6. Your rights
Under the UK GDPR you can ask us to: tell you what data we hold and give you a copy; correct it; erase it; restrict or object to our use of it; give it to you in a portable format; and withdraw consent at any time. Some rights do not apply in every case, for example we must keep records the law requires. To use a right, contact us as above. We will reply within one month. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113, but we would like the chance to put things right first.
7. Security
We use reasonable technical and organisational measures to protect your data, including secure connections, access controls, malware scanning and backups. No system is completely secure, so please keep your password private.
8. Cookies and similar technologies
Cookies are small files saved on your device. We use:
- Essential cookies that keep the website working: logging in, your basket and checkout, security, and remembering your progress in a course. These do not need consent.
- Payment and fraud prevention scripts from Stripe, PayPal and similar providers on the checkout page.
- Spam protection: Google reCAPTCHA on forms, which checks that a visitor is a person and uses your IP address and some browser data.
- Fonts and images loaded from Google Fonts and Gravatar, which receive your IP address.
- Measurement and advertising: the Meta (Facebook) Pixel and a Google tag, which help us understand visits and measure our adverts. These are not essential, and you can block them in your browser or with a privacy extension.
You can delete or block cookies in your browser settings, but parts of the site (such as login and checkout) may then not work. You can also manage Meta adverts at facebook.com/adpreferences and Google adverts at myadcenter.google.com.
9. Links and children
Our website links to other websites, such as social media and The CPD Register. We are not responsible for their privacy practices. Our courses are for people aged 18 and over, and we do not knowingly collect information from children.
10. Changes
We may update this policy. The date at the top shows when it was last changed, and we will tell you about any important change.