Welcome to Beauty Creator (https://beauty-creator.com), a website operated by BRIGHTLEARN SOLUTIONS LTD, a company registered in England and Wales (Company No. 16795220) with its registered office at 20 Wenlock Road, London, England, N1 7GU ("Company", "we", "us", "our"). This Privacy Policy explains what personal data we process, why we process it, the legal bases we rely on, how we protect it, and the rights available to you. Please read it carefully.

1. Data Controller

The Company acts as the data controller for the personal data described in this Policy, meaning it decides how and why your personal data is processed. We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and, where users are located in the European Union, Regulation (EU) 2016/679 (EU GDPR). Nothing in this Policy limits any mandatory data protection rights available to you under applicable law.

2. Contact Details of the Data Controller

Name: BRIGHTLEARN SOLUTIONS LTD

Address: 20 Wenlock Road, London, England, N1 7GU

Email: [email protected]

3. EU Representative

Where required by Article 27 of the EU GDPR because we offer services to, or monitor the behaviour of, individuals in the European Union, we will appoint an EU representative. 

4. Data Collection Sources

We collect personal data from various sources, including direct interactions where you provide information, such as when creating an account or making purchases. We also collect data automatically through cookies and similar tracking technologies, and we obtain data from third-party service providers (e.g. payment processors), government authorities or regulators, and publicly available sources.

5. Types of Data Collected

We may process the following categories of personal data:

• Contact Information: full name, email address, phone number, postal address.
• Identification Data: date of birth, place of residence, personal identification numbers, and identification document details.
• User Account Data: account credentials, settings, activity logs, referral links and IDs, workplace information, and job role.
• Transaction and Payment Data: details of orders, purchases, subscriptions, and other transactions. Payment card or bank details are processed securely by licensed third-party providers; we do not store full payment credentials.
• Technical Data: IP address, device type, browser details, and other technical information about your use of the Website.
• Marketing Data: your preferences and participation in marketing or loyalty programmes.
• User-Generated and Uploaded Content: documents, files, or data you upload or share through your account or our services.
• Compliance Data: information required to meet legal and regulatory obligations, including AML, CFT and KYC processes.
• User Support Data: information generated through support interactions, including issues reported, resolution details, and support communications.

6. Purposes and Legal Grounds for Processing

We process your personal data for the following purposes and on the following legal bases:

7. Recipients of Personal Data

We may share your personal data with trusted partners for the provision of our services, such as payment processors. We may also disclose your data to government authorities or regulators where required by law.

8. Data Retention

We retain your personal data only for as long as reasonably necessary to fulfil the purposes for which it was collected, including to satisfy legal, regulatory, tax, accounting or reporting requirements, or longer where there is a prospect of a complaint or litigation.

To determine the appropriate retention period, we consider the amount, nature and sensitivity of the data, the potential risk of harm from unauthorised use or disclosure, the purposes of processing, and applicable legal or regulatory requirements.

• Basic customer records (Contact Information, Identification Data, Payment Data, Transaction Data): a minimum of 6 years after you cease being a customer, for tax purposes.
• AML compliance records: typically up to 5 years.
• Data retained to protect our legal interests: typically up to 10 years, reflecting the applicable limitation period for claims.
• Data processed on the basis of consent: until you withdraw that consent.

Once personal data no longer serves a lawful purpose, we securely delete or anonymise it.

9. International Data Transfers

Your personal data may be transferred and processed outside the UK and/or the European Economic Area (EEA) by trusted service providers, including payment processors, cloud hosting providers, and compliance verification systems. Where this occurs, we ensure an equivalent level of protection through one or more of the following safeguards:

• transferring data only to countries the UK deems to provide an adequate level of protection; or
• using UK-approved standard contractual terms, namely the International Data Transfer Agreement or the International Data Transfer Addendum to the European Commission's standard contractual clauses; or
• using third parties subject to the UK Extension to the EU-U.S. Data Privacy Framework, where applicable.

All third parties that receive personal data are contractually bound to process it only for the purposes described in this Policy, to maintain confidentiality, and to apply appropriate technical and organisational safeguards.

10. Essential and Optional Personal Data

Certain personal data is required for the functionality and availability of our services. Failure to provide mandatory (essential) information may limit your access to some features. Optional information can be provided and managed in line with your preferences via account settings. Mandatory fields are clearly marked as such.

11. Data Security

We implement a range of measures to protect your personal data, including encryption in transit and at rest, role-based access controls and multi-factor authentication, regular staff training, periodic security audits, data minimisation, and an incident response plan for data breaches.

You can further protect your information by using strong, unique passwords, enabling two-factor authentication, keeping devices and software up to date, using reputable security software, avoiding public Wi-Fi for sensitive transactions, monitoring your accounts regularly, remaining alert to phishing attempts, and backing up important data.

12. Data Subject Rights

Subject to applicable legal conditions, you have the right to:

• Access your personal data and obtain a copy of it.
• Rectification of inaccurate or incomplete data.
• Erasure of your personal data in certain circumstances.
• Restriction of processing in specific situations.
• Object to certain processing, such as direct marketing.
• Portability of your data in a commonly used, machine-readable format.
• Withdraw consent at any time where processing relies on consent.

We may need to verify your identity before fulfilling a request. To exercise any of these rights, contact us using the details in Section 2.

13. Automated Decisions and Profiling

We do not use automated decision-making that produces legal effects or similarly significantly affects you; decisions with such effects are always made by a human. We may use profiling to personalise your experience, for example by suggesting content that matches your interests. Any profiling we carry out is transparent, fair, and respects your privacy rights.

14. Use of Cookies and Analytics Tools

Our Website uses cookies and analytics tools to ensure smooth operation, enhance your experience, and understand how visitors interact with the platform. Where required by law, we request your consent for non-essential cookies (such as analytics or marketing tools) through a cookie banner shown on your first visit. You can manage or withdraw consent at any time via the platform settings or your browser controls. Disabling cookies may affect certain features. Full details are set out in our Cookie Policy.

15. Data of Minors

Our Services and Website are not intended for individuals under the age of 18 ("Minor"). We do not knowingly collect, process, or store personal data from minors. If we become aware that we have inadvertently collected a minor's personal data, we will take prompt steps to delete it. If you are a parent or guardian and believe your child has provided us with personal data, please contact us so we can address this and remove the data. By using our Services, you confirm that you are not a Minor.

16. Complaints

If you have concerns about how we handle your personal data, please contact us first so we can investigate and resolve the issue. You also have the right to complain to your local data protection authority. In England, this is the Information Commissioner's Office (ICO):

Information Commissioner's Office — Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Helpline: 0303 123 1113

Website: https://www.ico.org.uk/make-a-complaint

17. Updates to This Policy

We may update this Policy periodically to reflect changes in our practices or legal requirements. Where we make significant changes, we will notify you by a notice on our Website, by email, or by other appropriate means. Continued use of our Services after such changes constitutes acceptance of the updated Policy.

18. Contact Information

For questions about the protection of personal data, or to raise a complaint or submission, please contact us at [email protected].

Last updated: 23 July 2026