Privacy Notice — Bombshell Nails London

01 / Privacy

Who is responsible for your information?

BOMBSHELL NAILS LONDON LTD is the controller of the personal information we use to run our education and professional collaboration business. Natalia Bulat is your contact for privacy questions.

Company number: 14300200 · Registered in England and Wales
Registered office: Grantham House 46 Botanic Square, Flat 907 Grantham House, London, England, E14 0LW
Email: enrolment@bombshellnailslondon.com
Mobile: +44 7553 155915

This notice covers website enquiries, private London courses, live Zoom training, assessment and diplomas, business mentoring, guest teaching and speaking, and UGC collaborations. It also explains how we handle information about models and people featured in content.

02 / Privacy

What we collect & where it comes from

We receive information directly from you through emails, phone calls, messages, enquiry forms, bookings, live sessions and case-study submissions. Where you use Booksy or Square, they provide the booking or transaction details needed to administer your booking.

Contact and booking details: your name, email, phone number, billing details, service choice, dates, country and time zone.
Training and assessment: your experience, qualifications, learning goals, practical work, case-study images, feedback and diploma details.
Business enquiries: your role, organisation, venue, group size, mentoring goals or brand brief, and agreed content usage.
Transactions and correspondence: invoices, amounts, payment status, booking communications and any concern you raise.
Images and session information: photographs, video or voice where these are submitted for assessment or separately agreed for content. Using a video call does not itself give permission to record or publish it.
Technical information: IP address, browser or device information and access logs may be processed by the website and services it loads. Cookies and external services are explained below.

A student or event organiser may provide a model’s or participant’s information. Tell them who we are and share this notice before sending their details. Public business profiles may help us understand a mentoring or collaboration enquiry; we use only information relevant to that enquiry.

Fields marked required are needed to respond or arrange the requested service. Without essential booking, payment or qualification details, we may be unable to confirm training or issue the correct diploma. Optional information is your choice. Courses are for students aged 18 or over.

03 / Privacy

Why we use it & our lawful bases

Responding and arranging your service

We use contact details, goals, dates and relevant qualifications to answer your enquiry, confirm suitability, prepare and deliver training or mentoring, assess work, provide support and issue diplomas. For your own booking, the basis is taking steps at your request before a contract or performing our contract with you.

Working with organisations and models

For a host or brand contact who is not personally a party to the contract, and for necessary information about a model, we rely on legitimate interests: arranging the engagement, communicating with the right person and supporting safe practical work and assessment. We limit the information to what is relevant and consider its impact on you.

Accounting and legal requirements

Invoices and required transaction records are processed to meet our legal obligations, including company accounting and tax record requirements.

Administration, security and concerns

We rely on legitimate interests to keep accurate business records, protect our systems, respond to service concerns and establish or defend legal claims. These interests are balanced against your rights; they do not justify collecting unnecessary information.

Promotional images and optional marketing

We seek separate consent to publish an identifiable student’s or model’s image, voice or name for promotion. If we offer optional email or message marketing, we obtain the permission required by law and provide an easy way to stop it. Booking messages are separate from promotional messages.

Consent can be withdrawn by contacting us. This does not affect the lawfulness of earlier use. If we need to use information for a new purpose, we will explain that purpose and its lawful basis before doing so.

04 / Privacy

Case studies, models & sensitive information

Zoom students submit three case studies for approval before an electronic diploma is issued. We use the images and accompanying notes to assess technique and give feedback. Assessment submissions do not automatically become promotional content.

Photograph only what is needed to show the work. Avoid faces, names, location tags and other identifying details where possible. Obtain the model’s permission to photograph and share the work for assessment, give them this notice, and do not submit unnecessary medical histories or other private details.

If a health or accessibility detail is needed for safe participation or an adjustment, contact Natalia privately before training. We will explain the information needed, its use and the applicable legal basis. Where we rely on explicit consent for health information, we will ask for that separately before collecting or using it, alongside the applicable lawful basis for arranging your service.

Mentoring clients should avoid sending identifiable details about their own customers, employees or other people unless necessary and lawfully shared. Use anonymised examples wherever possible.

Course suitability and practical assessment are reviewed by Natalia. Our own assessment process does not make solely automated decisions with legal or similarly significant effects.

05 / Privacy

Your image & promotional permission

We ask separately before using an identifiable image, voice, testimonial or name on the website, social media or in promotional material. The request will describe the content, purpose and intended channels. You can decline without losing access to training.

Agreement to booking terms, attendance at an event or submission of a case study is not promotional consent. A host’s or student’s permission does not replace permission from other identifiable people featured in the content.

If you withdraw consent, we will stop new uses and remove content under our control where appropriate. We cannot guarantee removal of copies already downloaded or independently shared by other people, but will explain what we can do. Records needed to show consent or withdrawal may be retained separately from the content itself.

06 / Privacy

We share relevant information only where needed for the purpose described, with access limited to those who need it. The services currently identified for our business are:

Supabase — optional student accounts: Email and password sign-in, email verification, password recovery and account sessions. Supabase processes your account email and first name and manages your password securely. The selected authentication project is hosted in London. Your verified account is linked to eligible website booking and payment records so you can view them privately. Supabase privacy information
Website hosting — ChatGPT Sites / Cloudflare: Hosting and storage for this website, enquiry records, course-date reservations and saved email delivery records. Technical logs help protect and operate the service. Owner dashboard sign-in uses the owner’s ChatGPT account; students do not need a website account to enquire or purchase. OpenAI privacy information · Cloudflare privacy information
Resend: Delivery of website enquiries, student enrolment confirmations, booking notices, account verification, password reset messages and owner payment notifications by email. The enquiry details and reply email address are processed to deliver your message to Natalia. Resend privacy policy
Booksy: Natalia uses Booksy as a private, manually maintained booking diary and customer record. Website bookings are not transferred into Booksy automatically. This website does not offer public Booksy browsing or booking. Booksy also processes information for its own platform purposes. Booksy privacy information
Square: Payments, invoices and associated transaction records. Square also has its own privacy responsibilities. Square customer privacy notice
Gmail / Google: Email enquiries, booking correspondence and documents shared by email. Google privacy policy
Instagram / Meta: Direct messages, video mentoring and agreed promotional posts. Instagram privacy policy
Zoom: Live online teaching and session communication. Zoom privacy statement
FaceTime / Apple: Private mentoring video calls. Apple privacy information

These platforms may act on our instructions for some activities and as separate controllers for their own purposes. Their notices explain those purposes and your choices when using their services.

Relevant information may also be shared with an accreditation body where required to administer an accredited diploma, professional advisers, insurers or authorities where necessary or legally required. We will explain any course-specific accreditation disclosure before it occurs. Event organisers receive only the participant information needed to arrange the agreed engagement.

Do not send payment card numbers or security codes by email or Instagram DM. Use the secure Square payment form. During final connection checks, checkout uses Square Sandbox and cannot take real money. The live checkout will be clearly identified when activated.

07 / Privacy

Information processed outside the UK

Some communication, booking, payment and website providers may store information or allow access outside the UK. Their privacy information describes their processing locations and transfer arrangements.

Our email provider, Resend (Plus Five Five, Inc.), processes and stores email content and delivery records in the United States. Resend’s Data Processing Addendum includes Standard Contractual Clauses and the UK Addendum for UK transfers. Read Resend’s Data Processing Addendum.

Where our use of a provider involves a restricted international transfer, a lawful transfer route is required, such as a UK adequacy regulation or appropriate contractual safeguards. You can contact us to ask where your information is processed and for details or a copy of applicable safeguards, with confidential information removed where necessary.

Before this draft is published: confirm the provider entities, account arrangements, processing locations and transfer safeguards that apply to this business. The exact arrangements have not yet been verified; this draft does not claim that a particular transfer agreement is already in place.

OPTIONAL BASKET REMINDERS

Your saved courses.

When you provide your email during course checkout, we use it and your selected course options to send one reminder after three days without basket changes, only for courses that remain unpurchased. You can opt out beside the checkout email field or using the link in the reminder. There is no separate confirmation email and no further reminder for that basket. Course choices stay saved on your device until you remove or purchase them. We do not add you to a mailing list. You can turn the reminder off in your basket or through the link in the email.

Resend delivers these emails. The basket remains saved in your browser; a private link can restore its course options on another browser. Saving a course does not reserve a date. Reminder links expire after 30 days, and reminder requests, delivery records and related suppression records are deleted within 90 days. We keep minimal delivery records during that period to prevent duplicate messages and respect your choices.

08 / Privacy

How long we keep it

Enquiries that do not become bookings: Up to 12 months from our last meaningful contact, then deleted, unless needed for a specific unresolved concern or legal requirement.
Core booking and service records: Six years after the service ends for essential booking, completion and transaction records. Company accounting records are kept for at least six years from the end of the relevant financial year, or longer where the law requires.
Case-study images and assessment material: Only for as long as needed to complete assessment, address related feedback or a review, and meet any applicable accreditation requirement. Images are then deleted or anonymised; a minimal completion and diploma record may remain with the core booking record.
Sensitive information: Only while needed for the stated adjustment or safety purpose, unless a specific legal or incident-related requirement justifies longer retention.
Promotional content and consent records: While the agreed use remains relevant and consent remains valid. Withdrawal stops new use; a limited consent or withdrawal record may be retained to document your instructions.

We review records and delete or anonymise information when it is no longer needed. A specific dispute, insurance matter or legal requirement may justify keeping relevant records longer; it does not justify retaining everything. Provider-held records and backup copies may have their own deletion cycles, which must also be considered when carrying out these periods.

09 / Privacy

Website technology, cookies & other links

Website forms submit your enquiry directly to our website server and deliver it to Natalia by email through Resend. They collect the details you choose to enter, including your name, email address, mobile number with country code and enquiry. A secure server record supports reliable receipt and delivery. Resend and Gmail process the message as part of delivery and correspondence.

A temporary submission reference and fingerprint are kept in your browser session to prevent duplicate enquiries; your form answers are not stored there. A short-lived, pseudonymous identifier derived from your IP address helps limit spam. These rate-limit records are set to expire after 24 hours and are removed by the hourly website maintenance checker after expiry.

The basket saves your selected course, professional role and payment option in your browser using bombshell-course-basket-v1 local storage. It does not store your name, email address, chosen training dates or payment-card details. Selections stay on the same browser and device until you remove them, clear browser storage or complete checkout for that selection, including the first instalment of a monthly plan. Adding a course does not reserve a teaching date.

A confirmed website purchase prepares a student dashboard linked to the booking email. You activate sign-in by choosing a password and verifying that email; later purchases using the same email appear in the same account. If you use a student account, Supabase keeps a sign-in session in browser local storage under bsl-student-auth-v1, so you can remain signed in and renew your session. A separate bsl-student-signed-in flag controls the account shortcut. Logging out removes the local account session. Account baskets are also saved on our website server against your verified account and synchronised across signed-in devices. Guest checkout remains available without creating an account.

The website’s photographs and the Cormorant Garamond and DM Sans font files are hosted with this website. Square’s payment library and secure card form load when you open checkout. Apple Pay and Google Pay, where available, use their respective payment services. An external link, including directions or Instagram, takes you to a separate service with its own privacy information.

Cloudflare sets a security cookie named __cf_bm to help distinguish automated traffic and protect the website. Cloudflare states that it expires after 30 minutes of continuous inactivity. It is separate from the course basket and does not contain a website customer account identifier. Cloudflare states that cookie data may be processed in the United States by default; the account-specific localisation and transfer arrangements remain part of the review below. Cloudflare cookie information.

We have not added advertising pixels or optional visitor analytics to the first-party website code. This statement does not replace checking the behaviour of third-party payment and hosting services.

The form uses session storage named bombshell-enquiry-contact, bombshell-enquiry-course, bombshell-enquiry-mentoring, bombshell-enquiry-host or bombshell-enquiry-ugc, depending on the form. It keeps only a submission reference and fingerprint until receipt is confirmed or the browser session ends. Website hosting, owner sign-in and payment integrations may also use cookies or similar storage technologies. Essential technologies may operate where the law allows; any technologies requiring consent must wait until the appropriate choice has been made. Where a lawful statistical-use exemption applies, its conditions and any required way to object must be provided.

Before publication: audit the final live site and confirm its hosting, cookie names, purposes, providers, durations and consent or objection controls. This review draft does not yet contain a verified live cookie inventory or working cookie preference control.

10 / Privacy

Protecting your information

Access should be limited to people who need information for the agreed purpose, with appropriate account, device and file protection. We aim to collect only relevant information and use suitable channels when sharing it. No online service can guarantee absolute security.

If you believe information has been sent to the wrong person or used improperly, contact Natalia promptly. We will review the concern and take the steps required by data protection law, including notifications where legally required.

11 / Privacy

Your choices & data rights

Depending on the circumstances, you can ask to access your information and receive a copy, correct inaccurate details, delete information, restrict its use, or receive and transfer certain information in a portable format. You can object to processing based on legitimate interests, and you can object to direct marketing at any time.

You can withdraw consent for processing based on consent. These rights are not all unconditional: for example, a request to delete information may not cover accounting records we must legally keep. We will explain any limitation and the reason for it.

Email enrolment@bombshellnailslondon.com, phone +44 7553 155915 or write to the registered office above. Describe your request and the information involved. We may ask for proportionate information to verify your identity. We respond within the applicable legal time limits, normally one month, and explain any lawful extension or clarification needed. Requests are normally free of charge.

12 / Privacy

Privacy concerns, complaints & updates

If you have a privacy concern, contact Natalia using the details above. We will review what happened, discuss the action needed and explain our response.

You also have the right to complain to the UK Information Commissioner’s Office. The ICO generally asks you to raise the issue with the organisation first. Make a complaint to the ICO . If you live elsewhere, you may also have the right to contact your local data protection authority.

We will update this notice when our services or use of information changes. The date at the top identifies the version; material changes will be brought to your attention where appropriate. This is a review draft dated 15 October 2026 and is not yet the published notice.

PrivacyNotice.