Activate Learning Further Education Corporation is the controller of personal information and is subject to the Data Protection Act 1998 (DPA) and the General Data Protection Regulation (GDPR).
We may collect, use and share your personal information in order to provide you with information about the services we offer.
What information we hold
The categories of personal information that we collect, hold and share include:
- Personal information: We request the minimum level of personally identifying information to run our business effectively. This is data you provide us directly, for example, your name and contact details. We do not obtain information about you from sources outside our business.
- Preference information: We store notes with respect to services undertaken to ensure we maintain our level of service. For example, your preferred hair style, colour formulas, nail colour and beauty treatments. You have the opportunity to give consent for us to store personally identifying information and service information about your services based on your receiving them from us, when you provide this information to us.
- Depending on the particular service we are providing we may be required to ask questions related to your medical history. We will always obtain your consent prior to storing information related to your medical history. Examples of medical data may be allergies, pregnancy or any injury that may impact our service.
Why we hold your information
We use your information to:
- Appointment confirmations and reminders. We will contact you via phone, email or SMS. You may opt out at any time;
- Provide you with relevant information about our services. You may opt out at any time.
- Monitor our customer base to develop more effective communication by asking you to rate our services and provide feedback. You may opt out at any time;
- Marketing: Our marketing campaigns are automated and use rules based on services and products purchased and information we collect from you. We may send marketing campaigns related to your birthday, the fact we miss you (not visited for 3 months) and other special days, Valentine's Day and Christmas. You may opt out at any time;
- Comply with the law regarding data sharing;
- Comply with our contractual obligations.
The lawful basis for using this information
Under GDPR, we are able to process information on certain legal grounds (bases). In this case, we collect and use your information on the basis of your explicit consent. You have the right, at any time, to withdraw your consent to our processing of this data. If you wish to do so, please contact the Oxford Lifestyle Centre Hair and Beauty Team 01865 551895 or email firstname.lastname@example.org. Please note that withdrawing your consent to our processing your personal data may prevent us from being able to provide services to you.
All of the information you provide to us is done so voluntarily. We do not share or sell the information outside of our business, we collect only and for no other purpose than to provide our services to you. A minimum level of personally identifying information is necessary for that provision.
We store information securely and in line with our Data Protection Policy and associated procedures. A copy of our Data Protection Policy can be obtained from the Data Protection Officer, whose contact details are listed below. We hold your information only for as long as your explicit consent allows us to, which will normally be no longer than one year, unless you confirm your consent to our holding and processing your information.
Who we share information with
If you attend one of our campuses, we may share your information with Department of Health and Social Care for the purpose of supporting NHS Test and Trace activity; we are legally required to share information in this way. You can read the Department of Health and Social Care privacy notice here.
We do not share your information with anyone unless it is necessary and in line with the purpose for which it was collected. Where data is routinely shared, a data processing agreement will be established to ensure the protection of your information.
Requesting access to your personal data
Under data protection legislation, you have the right to:
- Request access to the information we hold about you (Subject Access Request);
- Be informed of the identity of the controller, the reasons for processing your personal data and other relevant information necessary to ensure the fair and transparent processing of personal data;
- Object to processing of personal data that is likely to cause, or is causing, damage or distress;
- Prevent processing for the purpose of direct marketing;
- Object to decisions being taken by automated means;
- In certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed; and/or
- Claim compensation for damages caused by a breach of the data protection regulations.
Ref: LC0001C Version: 001 Date: April 2018