Privacy Policy

This website is operated by [LEGAL / TRADING NAME] ([SOLE TRADER OR LIMITED COMPANY]), trading as Sadie Ozoun, of [BUSINESS ADDRESS]. We are the “data controller” for the personal information described in this policy, which means we decide how and why it is used. Where applicable, our registration number with the Information Commissioner’s Office is [ICO REGISTRATION NUMBER — if registered].

If you have any question about this policy, or want to exercise any of your rights, email us at makeupbysadie@outlook.com or use our contact page.

• Account details — your name, email address, phone number and password (stored in an encrypted, unreadable form).
• Order details — what you bought, the amount paid, your delivery address, and the status of your order.
• Course details — which courses you are enrolled on and your progress through them, including which lessons you have started or completed and how much of a course you have watched.
• Booking enquiries — the name, contact details, event date, location and service details you give us when you enquire about makeup services.
• Correspondence — emails and messages you send us, including support and complaint history.
• Marketing preferences — whether you have opted in to hear from us, and whether you have unsubscribed.
• Technical data — IP address, browser and device type, and server log data generated when you use the site.

We do not ask for special category data (such as health information). Please do not send us health or medical details in enquiries or messages. If you choose to tell us about a skin condition or allergy so we can help you, we will use that information only to answer your question.

We never receive or store your full payment card details — see payments.

• Directly from you — when you create an account, place an order, enrol on a course, submit a booking enquiry, sign up for emails or contact us.
• Automatically — as you use the site, through strictly necessary cookies and server logs, and as you watch course videos (which records your progress against your account).
• From our payment provider — Stripe confirms to us that a payment succeeded and passes on the billing name, delivery address and the last four digits and type of the card used.

We only use your personal data where the law allows us to. In most cases that is one of the following.

• To perform our contract with you — creating and managing your account, taking payment, dispatching and delivering orders, granting and maintaining course access, tracking your course progress so you can pick up where you left off, handling returns and refunds, and answering your questions about an order.
• For our legitimate interests — keeping the site and accounts secure, preventing fraud and abuse of course access, understanding how our courses and shop are used so we can improve them, keeping records of enquiries, and sending marketing to existing customers about similar products (see below).
• With your consent — sending marketing emails where you have signed up, and any future use of non-essential cookies. You can withdraw consent at any time.
• To comply with the law — keeping accounting and tax records, and responding to lawful requests from authorities.

We do not carry out automated decision-making or profiling that produces legal effects for you.

All payments are processed by Stripe Payments Europe, Ltd. and its group companies. When you pay, your card details are entered on Stripe’s own secure checkout and are sent directly to Stripe. We never see or store your full card number, expiry date or security code.

Stripe processes your data as a separate data controller for its own fraud prevention, regulatory and anti-money-laundering purposes, under its own privacy policy.

If you pay using a third-party provider such as Klarna, Clearpay or PayPal, that provider collects and uses your data under its own privacy policy, including for credit and affordability checks where relevant. We only receive confirmation that the payment succeeded.

Cookies are small files stored on your device. We currently use strictly necessary cookies only — the ones needed to make the site work, which do not require your consent:

• Sign-in session — keeps you logged in as you move between pages and protects your account.
• Shopping basket — remembers what you have added to your basket before checkout.
• Payment and security — cookies set by Stripe during checkout to process your payment and detect fraud.

We do not currently use analytics, advertising or tracking cookies, and we do not share your browsing behaviour with advertising networks. If that changes, we will update this policy and ask for your consent before any non-essential cookie is set.

You can block or delete cookies through your browser settings, but the site may not work properly if you block the cookies listed above — in particular, you will not be able to stay signed in or complete a purchase.

We may send you emails about new courses, products, offers and events where you have asked us to, or where you have bought from us before and we are telling you about similar products and services. We will always give you the chance to opt out when we first collect your details.

Every marketing email includes an unsubscribe link, and you can opt out at any time by emailing makeupbysadie@outlook.com. Opting out of marketing does not stop service messages that we have to send you, such as order confirmations, dispatch notices, course access details and receipts.

We do not sell or rent your personal data to anyone, and we never will.

We share your data with a small number of service providers who process it on our instructions, under contracts that require them to keep it secure and use it only for the purposes we specify.

• Supabase — hosts our database, user accounts and file storage.
• Stripe — processes payments and refunds.
• Cloudflare — hosts and streams our course videos.
• Resend — sends our transactional and marketing emails.
• [HOSTING PROVIDER] — hosts this website.
• Delivery carriers — receive your name, delivery address and contact details so they can deliver your order.

We may also share data with our accountants and professional advisers, and we may disclose it where we are required to do so by law, by a court, or to protect our rights. If our business is ever transferred to someone else, customer data may be transferred with it, and we would tell you first.

Our database and account data are hosted in the European Union. Some of our providers are based outside the UK, or use infrastructure outside the UK, which means your data may be transferred internationally.

Where that happens, we only transfer data to a country the UK government has decided provides adequate protection, or under an approved transfer mechanism such as the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, together with appropriate additional safeguards.

• Order and payment records — six years from the end of the financial year they relate to, because tax law requires it.
• Course enrolments and progress — for as long as you have access to the course, since access is for the lifetime of the course and your progress is part of it.
• Account details — while your account is open, and then deleted or anonymised once you ask us to close it, subject to the record-keeping periods above.
• Booking enquiries — [RETENTION PERIOD, e.g. 24 months] from your last contact with us.
• Marketing preferences — we keep a record of your opt-out indefinitely so that we do not contact you again by mistake.

Under UK data protection law you have the right to:

• ask for a copy of the personal data we hold about you;
• have inaccurate or incomplete data corrected;
• ask us to delete your data, where there is no good reason for us to continue holding it;
• ask us to restrict how we use your data while a concern is resolved;
• receive the data you gave us in a portable, machine-readable format, or have it sent to another provider;
• object to us using your data for our legitimate interests, and to object to direct marketing at any time; and
• withdraw your consent at any time, where we relied on consent.

To exercise any of these, email makeupbysadie@outlook.com. There is no fee, and we will respond within one month. We may ask you to confirm your identity first. Note that deleting your account will also end your access to any course you are enrolled on, and we cannot restore it afterwards.

We use appropriate technical and organisational measures to protect your data. All traffic to this site is encrypted in transit, passwords are stored in a hashed form that we cannot read, access to customer data is limited to those who need it, and payments are handled on our payment provider’s own secure pages.

No system can be guaranteed completely secure. We have procedures to deal with any suspected data breach and will notify you and the Information Commissioner’s Office where we are legally required to do so.

This website is intended for adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us their personal data, please contact us and we will delete it.

We may update this policy from time to time. The date at the top of this page shows when it was last changed. Where the changes are significant, we will tell you by email or by a notice on the site.

The terms on which we sell to you are set out in our Terms and Conditions.