1. Purpose

This policy explains how Elemental Massage LTD collects, uses, stores and shares personal information in connection with course enquiries, bookings, training delivery, assessment, certification, tutor administration and related school activities. The School is responsible for handling personal data in accordance with the UK GDPR and Data Protection Act 2018.

2. Personal information we may collect

• Identity and contact information such as name, address, telephone number and email.

• Booking, payment, invoice and transaction information.

• Course history, attendance, assessment outcomes, certificates, learner communications and quality-assurance records.

• Qualification/prerequisite evidence and professional information.

• Information provided in complaints, appeals, feedback or support requests.

• Health, disability, allergy or other special-category information where necessary for safety, reasonable adjustments or practical participation.

• Images/video where explicit permission has been obtained for the relevant purpose.

• Website/device information collected through the website and its service providers, subject to applicable cookie/privacy controls.

• Tutor/contractor details needed to administer teaching, accreditation and payments.

3. Why we use personal information and lawful bases

Purpose

Typical lawful basis

Examples

Respond to enquiries and manage bookings

Contract / steps at your request before contract

Enquiries, registration, course changes, learner communications

Deliver and administer training

Contract; legitimate interests

Attendance, learning support, assessment, certification, quality assurance

Meet legal/accounting obligations

Legal obligation

Financial records, tax/accounting, safety records, data-protection compliance

Protect safety and manage incidents

Legitimate interests; legal obligation where applicable

Risk management, accident/incident records, emergency response

Reasonable adjustments / relevant health information

Explicit consent or another applicable Article 9 condition depending on context

Accessibility and safe participation information

Marketing

Consent where required; legitimate interests where lawful

Email/news updates and promotions

Defend or establish legal claims

Legitimate interests; legal claims condition where special-category data is involved

Complaints, disputes, insurance matters

4. Special-category information

Health and disability information is particularly sensitive. The School will collect only what is reasonably necessary, limit access, and use it for purposes such as reasonable adjustments, safe participation or incident management. Where explicit consent is the appropriate condition, it will be requested clearly and separately.

5. Sharing personal information

Information may be shared where necessary with service providers that support booking, payment, communications, website hosting, document storage or administration; tutors who need information to deliver the course safely; accrediting/awarding organisations where required; professional advisers/insurers; and public authorities where there is a legal duty. The School does not sell personal data.

6. International processing

Some technology providers may process information outside the UK. Where UK data-protection law requires safeguards for an international transfer, the School will rely on an approved transfer mechanism or other lawful safeguard appropriate to the provider and transfer.

7. How long information is kept

• Training, certification, complaints and insurance-related records are normally retained for a period appropriate to accreditation, contractual, legal and insurance requirements; six years may be used as a general operational benchmark unless a different period is required.

• Financial records are retained for the period required by tax/accounting law.

• Marketing records are kept until consent is withdrawn or the information is no longer needed.

• Health/adjustment information is not retained longer than necessary for the purpose for which it was collected, subject to any legal or claims-related need.

• Retention periods may be extended where a complaint, legal claim, safeguarding matter or regulatory requirement requires it.

8. Security

• Access to personal information is limited to people who need it.

• Electronic information should be protected by appropriate passwords/access controls.

• Paper records containing personal or health information should be stored securely.

• Personal data should not be sent to unintended recipients or discussed where it can be overheard.

• Data breaches or suspected losses must be reported promptly to the Director so that legal notification duties can be assessed.

9. Your rights

Depending on the circumstances, individuals may have rights to be informed, access their information, rectify inaccurate information, erase information, restrict processing, object to processing, receive portable data, and rights relating to automated decision-making. Some rights are subject to legal conditions and exemptions.

10. Marketing and consent

Where marketing relies on consent, consent may be withdrawn at any time. Withdrawing marketing consent does not affect essential course administration or other processing that has a different lawful basis.

11. Complaints about data protection

Please contact Elemental Massage LTD first so that concerns can be investigated. Individuals also have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection.

12. Privacy information at collection

Where personal data is collected directly, relevant privacy information should be made available at or around the time of collection. This policy may be supplemented by shorter privacy notices on booking forms, consultation forms, websites or other collection points.

​

​

​

​

​