Privacy Policy.

Who is responsible for your information

Picasso Academy is operated by the following company, which is the controller of the personal information described in this notice: PICASSO BARBERING ACADEMY LTD.

Registered in England and Wales. Company number: 15298965.

This policy covers visits to picassoacademy.co.uk and your communications with the academy about enquiries, courses and related services.

Information we collect

When you contact us by email or telephone, we receive the contact details and information you choose to share, such as your name, email address, telephone number, course interests and correspondence. Please only send information relevant to your enquiry.

For course administration, we may need learner and payer contact details, booking and payment records, attendance, assessment and certificate information, and relevant guardian details. These records arise from your dealings with the academy; this website currently has no account registration, online checkout or enquiry submission form. We do not ask you to send card details by email.

When you visit the site, the hosting servers may process technical connection information such as IP address, browser and security logs. If configured and accepted, optional Google Analytics measures named public button clicks. We do not send personal form contents or payment details as analytics events. No advertising pixels or session recording are installed.

Why we use information and our lawful bases

Enquiries and bookings: we use relevant information to answer your questions and take steps you request before entering a contract, and to deliver and administer a course contract. Where an enquiry is not about a contract, our legitimate interest is responding helpfully to people who contact the academy.

Administration and legal obligations: we keep records required by applicable accounting, tax or other laws to comply with legal obligations. Where not required by law, handling complaints, maintaining accurate training records and establishing or defending legal claims relies on our legitimate interests in running the academy fairly and protecting its legal position. We consider your rights and only use information necessary for those purposes.

Website operation and security: our legitimate interests are providing a working, secure website, preventing misuse and investigating technical problems. A language preference requested by you is used to show the site in your chosen language.

You do not have to provide optional information. Without details needed to answer an enquiry, arrange a booking, deliver training or meet a legal requirement, we may be unable to provide the relevant service. We explain any mandatory information when requesting it. We do not make decisions producing legal or similarly significant effects solely through automated processing.

Marketing and photographs

An enquiry or course booking does not automatically sign you up for marketing. If we offer optional marketing messages, we seek consent unless a specific lawful exception applies and its conditions are met. You can withdraw consent or object to direct marketing at any time using the message’s unsubscribe option or by contacting us. Service messages about your enquiry or course are separate from marketing.

Using identifiable photographs or video for public promotion requires separate, optional permission explaining the intended use. Refusing does not affect your place on a course. You can withdraw permission for future use; withdrawal does not make earlier lawful use unlawful. Contact us about removing material from channels we control. We explain separately if an image is needed for assessment rather than promotion.

Young learners and sensitive information

Our courses are available from age 16. For learners aged 16 or 17, we may need appropriate parent or guardian contact and permission records. Young learners have their own privacy rights; a guardian is not automatically entitled to all their records. We explain uses in an age-appropriate way and take particular care with promotional images and safeguarding information.

Please do not send unnecessary medical details. If health, disability or other sensitive information is needed to arrange safe participation or reasonable adjustments, we explain what is necessary, who needs access and the applicable lawful basis and additional special-category condition before collecting it. This may include explicit consent where appropriate; where another legal condition is needed, we explain it. Access is limited to those who need it.

Cookies and the optional map

The language preference cookie lasts up to one year. Optional Google Analytics loads only after acceptance and can store _ga and _ga_<measurement-id> cookies for up to 180 days. The analytics choice is saved locally for 180 days. Google receives connection and device information and may process it outside the UK. See the Cookie Policy and use Privacy settings to withdraw consent for future collection; withdrawal does not erase data already sent.

The embedded Google map loads only after you select “Load Google map”. Loading it connects your device to Google, which receives connection information and may use cookies or similar storage under its own policies. This choice is not saved as a persistent consent preference. You can use the address or external directions link instead. Other external links take you to services with their own privacy notices.

Cookie information · Google Privacy Policy

Who may receive information

Information is available to authorised academy personnel and, where needed, suppliers supporting website hosting, email, IT and record storage. Relevant course records may be shared with an assessment or certification organisation where required for the course, with details explained when you enrol. Professional advisers, insurers or authorities may receive necessary records for advice, claims or legal obligations. If a third party pays for your course, we do not automatically give them access to all your learner records.

We limit disclosures to what is needed and require suppliers acting on our behalf to protect information and follow appropriate instructions. We do not sell personal information or share it with advertisers for targeted advertising. If information is obtained from a guardian, payer or certification organisation, we explain the relevant source and use as required.

International transfers

Some suppliers or external services may process information outside the UK. Where we make a restricted international transfer, we must use a valid UK transfer mechanism, such as applicable UK adequacy regulations or appropriate safeguards including the UK International Data Transfer Agreement or UK Addendum, with any required assessment and additional protection. Contact us for details of any transfer affecting your information and how to obtain the relevant safeguards. External services you choose to visit explain their own processing in their privacy notices.

Retention and security

We keep information only as long as needed for the purpose for which it was collected. For enquiries, this depends on resolving the enquiry and any resulting course discussion. For learner, booking and financial records, we consider the course relationship, assessment or certification requirements, applicable legal record-keeping duties and the period needed to address complaints or legal claims. Sensitive information is reviewed against the continuing need for support or safety; promotional material is reviewed against the agreed use and any withdrawal. Records no longer needed are deleted or anonymised, subject to necessary legal holds. Contact us for the retention criteria applying to a particular record.

We use proportionate technical and organisational measures to protect information, including limiting access to people who need it. No internet transmission or storage system can be guaranteed completely secure. If a breach occurs, we assess it and notify affected people and the regulator where the law requires.

Your data protection rights

Subject to the conditions and exceptions in UK data protection law, you can request access to your information, correction, erasure, restriction of processing and portability of eligible information. You can object to processing based on legitimate interests, and you have an absolute right to object to direct marketing. Where we rely on consent, you can withdraw it at any time without affecting earlier lawful processing. Some records may need to be kept despite an erasure request, for example to meet a legal obligation.

Contact us using the details below. We may request proportionate identity checks to protect your information. Requests are normally free and answered without undue delay, usually within one month. Where the law permits an extension, a fee or refusal, we explain the reason and your options; for a permitted extension we notify you within the initial month. You do not need to use a particular form.

Changes to this policy

We update this notice when our practices or legal requirements change and show the revision date above. Where required, we draw significant changes to your attention before using information for a new purpose and seek fresh consent when needed.

Contact, requests and complaints

For privacy questions, rights requests or a complaint about personal information, contact the academy:

We investigate privacy complaints and explain the outcome without undue delay. You also have the right to complain to the UK Information Commissioner’s Office (ICO); you do not need our permission.

Make a complaint to the ICO