Privacy Policy
This Privacy Notice explains how we (Phenomenail™) collect and use your personal information for our webshop and education services (in-person, live online, and on-demand).
If anything here isn’t clear, email support@phenomenail.co.uk
1) Who we are (controller)
Controller: Lauren Mitchell, trading as Phenomenail™
Address:
Phenomenail™ Creative Nexus
Compliance and Legal Office
Lytchett House, 13 Freeland House,
Wareham Road, Lytchett Matravers, Poole, Dorset BH16 6FA, UK
Domains: phenomenail.co.uk (and related domains: phenomenail.uk / phenomenail.us / phenomenail.world)
2) Contents
Scope
What we collect
How we use your information & legal bases
Sharing & processors
Cookies & analytics
International transfers
How long we keep it
Security
Children
Your rights
Changes to this notice
How to contact us
3) Scope
This notice covers: our website and webshop; enquiries and bookings; live education delivered in-person or online (Zoom/Microsoft Teams); on-demand course access; student support (WhatsApp — opt-in only for enrolled students); and our marketing communications.
4) What we collect
Information you provide
Account / contact details (name, email, phone, postal/billing addresses, preferences, login details).
Order & booking details (items purchased, course selections, dates, notes you add).
Student records for training and certification (progress, assessments, attendance, certificate details).
Health information (special category, optional & consent-based): relevant notes you choose to share (e.g., allergies or sensitivities) for safety during in-person training/services.
Support messages and forms (including attachments you send).
Payment data
Card and BNPL details are processed by our providers — we do not see or store full card numbers/PANs. Providers in use: Wix Payments (major cards), Apple Pay, Google Pay, PayPal (incl. Pay in 3), Klarna, and Clearpay. BACS or cash may be used by prior arrangement.
Automatically collected
Technical & usage data (IP address, device/browser, pages viewed, timestamps, crash logs) for security, performance, and analytics.
Cookies and similar technologies (see Cookies & analytics).
Sources from others
We may receive basic data from payment processors and platforms we use (e.g., transaction confirmations), and from social platforms if you interact with our official accounts. We do not buy third-party marketing lists.
5) How we use your information & legal bases
Provide our services (webshop fulfilment; course delivery; student support) — contract.
Account management & authentication — contract.
Payments, refunds, fraud prevention — contract / legitimate interests / legal obligation.
Student progress, assessment & certification — contract / legitimate interests.
Course scheduling & operational communications (email/SMS/WhatsApp for enrolled students who opt in) — contract / legitimate interests.
Health & safety during in-person training/services (only where you choose to share relevant info) — consent.
Service communications (policy updates, changes) — legal obligation / legitimate interests.
Marketing (emails/SMS in line with your preferences; you can opt out anytime) — consent / legitimate interests.
Security, abuse and fraud monitoring; analytics; improvement — legitimate interests.
Legal & regulatory compliance — legal obligation.
You can withdraw consent at any time (for example, health notes or marketing) by contacting our Support Team or using unsubscribe links in emails. This won’t affect processing done before withdrawal.
6) Sharing & processors
We use carefully selected service providers (processors) under contract to help us run our services. They may only process your data on our instructions and must protect it.
Website & commerce: Wix (hosting, store, email/SMS automations, analytics).
Payments: Wix Payments, Apple Pay, Google Pay, PayPal (incl. Pay in 3), Klarna, Clearpay; bank providers for BACS.
Live online delivery: Zoom; Microsoft Teams.
Student support (optional): WhatsApp for enrolled students who opt in.
Cloud storage (internal): Google Drive (for our own file storage and records).
Couriers & fulfilment: as needed to deliver webshop orders.
Professional advisors & insurers: where reasonably necessary.
Law enforcement/regulators: where required by law.
We do not sell your personal data.
7) Cookies & analytics
We use the Wix consent banner with categories such as Essential, Analytics and Ads. You can change your choices any time using the Cookie Settings Preferences. We currently use Wix Analytics only. We may add Meta (Facebook/Instagram) advertising pixels in future; if we do, we will update this notice and the banner settings before enabling them.
8) International transfers
Some providers (e.g., Wix, payment gateways, video platforms) may process data in countries outside the UK (including the United States and Israel). Where this happens, we use appropriate safeguards, such as the EU/UK Standard Contractual Clauses and equivalent measures required by UK GDPR.
9) How long we keep it
Finance records: 6 years.
Training & insurance records (incl. certificates): 7 years.
Fraud/security logs: 12 months.
Support messages/tickets: 24 months.
Account data: while you have an account + a reasonable period for backups and audit, unless you ask us to delete it sooner and we are able to do so.
10) Security
We use technical and organisational measures appropriate to the risk (HTTPS, access controls, least-privilege, staff awareness, and processor contracts). No system is 100% secure; we monitor and work to mitigate risks.
11) Children
Our services are for adults. Minimum age is 18. We do not knowingly collect data from children. If you believe a child has provided data, contact us and we will delete it.
12) Your rights (UK/EU)
You have the right to request: access; rectification; erasure; restriction; portability; and to object to certain processing (including direct marketing). You also have the right not to be subject to a decision based solely on automated processing that has legal or similarly significant effects (we do not carry out such decisions).
How to exercise: Contact our Suuport Team. We may need to verify your identity. You can complain to the UK Information Commissioner’s Office. We would appreciate the chance to resolve matters first.
13) Changes to this notice
We may update this notice from time to time. We will post the new version here and change the “Last updated” date.
14) Contact
Questions about privacy or general requests?: Contact our Support Team
On-demand courses & recordings: your on-demand content is pre-recorded by us for purchasers only. We do not record live sessions with students