Privacy Policy

1. Introduction

The Sunbed Hub ("we", "our", or "us") is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, store, and protect your information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

By using our website and services, you agree to the collection and use of information in accordance with this policy.

2. Data Controller

THE HUB COLLECTIVE LTD

Trading as: The Sunbed Hub

Company number: 16874227

Registered in England and Wales

Registered office: REGISTERED OFFICE ADDRESS TO BE CONFIRMED BEFORE LAUNCH

Manual launch blocker: replace the registered office placeholder before production publication.

Email: hello@sunbedhub.co.uk

We are the data controller responsible for your personal data. If you have any questions about this Privacy Policy or how we handle your data, please contact us at the email address above.

3. Information We Collect

3.1 Salon Owner Registrations

When you register as a salon owner, we collect:

• Business name
• Contact name (first name and surname)
• Email address
• Phone number (UK format)
• Postcode and address
• Number of sunbeds
• Insurance renewal date (optional)
• Marketing consent preferences
• Referral code used (if any)

3.2 Staff Account Data

When a salon owner creates a staff profile, we may collect and store the following for each staff member:

• Staff member name
• Email address
• Job role or job title
• Linked salon and location
• Training activity (modules started, completed, time spent)
• Quiz results and scores
• Pass/fail records
• Certificates earned
• Activity history and login records
• Permission and access settings
• Account status (active, suspended, left)

Staff data is linked to the salon account and contributes to the salon's overall Compliance Score. Salon owners can view their staff records. Staff members can access their own profile and training history.

3.3 Supplier Registrations

When you register as a supplier, we collect:

• Company name and contact name
• Email address
• Phone number
• Business category and operating region
• Website and business description
• Logo (uploaded file)
• Historical billing references only, where required for accounting, dispute or audit records

3.4 Compliance Vault Documents

Salon members may upload documents to their Compliance Vault. These may include:

• Training certificates and proof of qualifications
• Insurance documents
• Risk assessment records
• Any other compliance or business documents you choose to upload

These documents are stored securely in private cloud storage and are accessible only to authorised users within your account. They are never shared with third parties or made publicly visible.

3.5 Compliance & Scoring Data

When you use our compliance tools, we collect and store:

• Uploaded document details: category, filename, upload date
• Document expiry dates and renewal dates entered by you
• Compliance status flags (current, expiring, expired, missing)
• Timestamped completion records for daily compliance checklists
• Equipment details and maintenance records
• UV lamp records and service history
• Compliance Score and Salon Score (platform-generated, based on the above)
• Staff-linked compliance and training contributions to the salon score

3.6 Multi-Location Data

Where a salon group has multiple locations, we may additionally collect:

• Individual location names and addresses
• Staff profiles linked to each specific location
• Location-level compliance documents and Vault records
• Location-level Compliance Scores

3.7 Training Records

When you or your staff complete training modules, we collect and store:

• Module completion status and scores
• Knowledge check answers and results
• Time spent reading each module
• Assessment pass/fail status and certificate records
• Date and time of completion

3.8 HubBot Conversations

When you use HubBot, our AI assistant, we store:

• Your messages and HubBot's responses
• Timestamps of each conversation
• Your user ID and role (to personalise responses)

HubBot conversation history is visible only to you and may be reviewed by our team for quality improvement purposes. You can clear your conversation history at any time from the HubBot page.

3.9 Payment and Membership Data

Salon membership is an annual paid service. The confirmed one-location salon price is £299 per year plus VAT (£358.80 including VAT), but live Stripe checkout is intentionally disabled until final external cutover. We do not collect card details through Sunbed Hub while checkout is disabled.

• We do not store card details directly
• Stripe customer, invoice, payment, refund or dispute identifiers may be retained where needed for accounting, membership access, refund, dispute or audit purposes
• Payment amounts, dates, VAT status, location tier and renewal dates may be retained for financial compliance and membership administration

3.10 Template Downloads

When members access or download templates:

• Template names and IDs accessed are recorded
• Date and time of download
• This helps us understand which resources are most valuable

3.11 Referral Programme Data

When you participate in our referral programme:

• Your unique referral code and any codes you used at signup
• Referral activity and rewards earned
• Qualifying signups attributed to your referral code
• Manual referral reward records (amount, date, recipient and admin status)
• Badges and achievements earned

3.12 Community Content

• Your forum posts and replies are publicly visible to all logged-in members
• You can edit or delete your own posts at any time
• Post content, timestamps, and your username are stored

3.13 Job Postings & Applications

• Job listing details (title, description, location, contact email) are stored and publicly visible
• Job applications are stored and visible to the posting employer
• CVs uploaded as part of a job application are stored in secure private storage

3.14 Automatically Collected Information

• Browser type and version
• Operating system
• IP address (anonymised for analytics)
• Pages visited and time spent on pages
• Referring website
• Profile view and click analytics (for supplier profiles)

4. How We Use Your Information

4.1 Lawful Basis for Processing

• Contract Performance: To provide your membership, directory listing, training, compliance tools, and member services
• Legitimate Interest: To operate and improve the platform, prevent fraud, process referral commissions, and maintain compliance scoring records
• Consent: To send marketing communications (only if you've opted in)
• Legal Obligation: To retain financial records and other data as required by UK law

4.2 Specific Uses

• To create and manage your account and any associated staff accounts
• To display your directory listing to other members and the public (business name, description, category, and location only; contact details to members only)
• To build and display your compliance audit trail, Compliance Vault status, and Compliance Score
• To calculate staff and salon-level compliance scores based on training and document records
• To maintain historic financial, dispute and referral reward records where legally or operationally required
• To send transactional emails (account updates, password resets, expiry reminders, important notices)
• To send marketing emails (only with your consent; you can opt out at any time)
• To calculate and pay referral commissions
• To personalise HubBot AI responses to your account role and context
• To prevent fraud and ensure platform security
• To improve our training content, templates, and platform features

5. Data Sharing and Disclosure

We do not sell your personal data.

Member contact details are never public. Your email, phone number, full address, and website are only visible to verified, approved members, not to the general public or search engines. Public visitors see only your business name, description, category, and town/city.

We may share your data with:

• Stripe: Payment, refund and dispute processing once checkout is enabled; checkout is disabled until final external cutover
• Resend: Transactional and marketing email delivery
• OpenAI: Your messages to HubBot are processed by OpenAI's API to generate responses. OpenAI does not retain your data for training purposes under our API agreement
• Google Cloud Storage: Private and public file storage (Compliance Vault, logos, CVs)
• Neon (PostgreSQL): Secure database hosting
• Legal Authorities: If required by law or to protect our legal rights

All third-party service providers are contractually required to handle your data in compliance with UK GDPR.

What is publicly visible (no login required):

• Directory listings: business name, description, category, and town/city only
• Job posting titles, descriptions, and locations (not contact emails)
• Supplier achievement badges and ratings

What is visible to verified members only:

• Email address, phone number, full address, website URL
• Location maps and full address details
• Job application contact details

6. Data Storage, Security & Retention

Your data is stored on secure UK/EU-based servers. We use:

• Encrypted data transmission (HTTPS/TLS)
• Secure database hosting (Neon PostgreSQL, UK/EU region)
• Private and public object storage separation (Google Cloud Storage)
• Bcrypt password hashing (cost factor 12)
• Secure, signed session tokens (httpOnly cookies)
• Role-based access controls

6.1 Data Retention

We retain your personal data for as long as your account is active. Upon a deletion request, account data is removed within 30 days, except where we are legally required to retain it (for example, financial records: 7 years).

The following categories of data may be retained or archived beyond the standard deletion window where necessary for platform integrity, legal obligations, dispute handling, fraud prevention, or legitimate business record purposes:

• Staff profiles and training records: May be archived rather than immediately deleted where they are linked to salon compliance history, certificates, or audit records
• Certificate records: Training completions, pass/fail history, and issued certificates may be retained
• Compliance history: Checklist completion records, Vault document history, and scoring data may be retained for audit purposes
• Financial and payment records: Retained for the period required by UK tax and accounting law
• Fraud prevention records: Retained as long as reasonably necessary

Where data is retained beyond a deletion request, it will be anonymised or restricted from active use where possible.

7. Automated Decision Making

We do not use automated decision making to make significant decisions about you. Compliance Scores and Salon Scores are platform-generated indicators based on data you enter. They are informational tools, not automated decisions that carry legal effect. Directory ranking is organic and does not use payment status, subscription tier, promotional status or boost status. All account approvals, content moderation, and referral reward decisions involve human review.

8. International Data Transfers

Some of our service providers may process data outside the UK:

• Stripe: Historical payment, refund and dispute records only where retained for audit or legal purposes
• OpenAI: AI processing for HubBot (US-based, Standard Contractual Clauses apply)
• Google Cloud: File storage (we select UK/EU regions where available)

We ensure appropriate safeguards are in place for all international transfers, including Standard Contractual Clauses where required.

9. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• Right to Access: Request a copy of all data we hold about you
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure ("Right to be Forgotten"): Request deletion of your data
• Right to Data Portability: Receive your data in a machine-readable format
• Right to Restrict Processing: Limit how we use your data
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Opt out of marketing communications at any time

To exercise any of these rights, please email us at hello@sunbedhub.co.uk. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

10. Cookies and Tracking

We use cookies to keep you logged in, remember your preferences, and (with your consent) measure usage via Google Analytics.

See our Cookie Policy for full details.

11. Third-Party Links

Our website contains links to external websites (suppliers, partners, etc.). We are not responsible for the privacy practices of these third-party sites. Please review their privacy policies before sharing your data.

12. Children's Privacy

Our services are intended for businesses and professionals only. We do not knowingly collect data from individuals under 18 years of age.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or via a notice on our website. The "Last Updated" date at the top indicates when the policy was last revised.

14. Contact Us

For any questions, concerns, or data requests, please contact:

THE HUB COLLECTIVE LTD (trading as The Sunbed Hub)

Company number: 16874227

Registered office: REGISTERED OFFICE ADDRESS TO BE CONFIRMED BEFORE LAUNCH

Manual launch blocker: replace the registered office placeholder before production publication.

Email: hello@sunbedhub.co.uk