Privacy Policy

1. Introduction

The Sunbed Hub ("we", "our", or "us") is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, store, and protect your information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This policy explains our data practices. We process information on the lawful bases described below; simply browsing this page is not consent to optional processing.

When an account holder accepts the Terms or acknowledges the Privacy Notice, we keep a versioned record associated with that account, including the document and wording version, timestamp, and the existing source and audit details. Marketing consent is optional, recorded separately, and can be withdrawn.

2. Data Controller

THE HUB COLLECTIVE LTD

Trading as: The Sunbed Hub

Company number: 16874227

Registered in England and Wales

Registered office: The Courtyard, Holmbush Farm, Crawley Road, Faygate, Horsham, RH12 4SE

Email: hello@sunbedhub.co.uk

We are the data controller responsible for your personal data. If you have any questions about this Privacy Policy or how we handle your data, please contact us at the email address above.

3. Information We Collect

3.1 Salon Owner Registrations

When you register as a salon owner, we collect:

• Your salon trading name, which is used as the business name on its public listing
• Private business identity details, which may include business structure, legal or registered name, company or other registration number where applicable, and your declaration about linked salon locations or other businesses under common ownership or control
• Identity-review information, such as verification status, evidence or notes supplied for a review, the reason for a decision, and the administrator and time associated with that decision
• Contact name (first name and surname)
• Email address
• Phone number (UK format)
• Postcode and address
• Number of sunbeds
• Insurance renewal date (optional)
• Marketing consent preferences
• Referral code used (if any)

Legal names, registration numbers, and identity-review details are private. They are available only to the authorised account holder in their own private account settings and to authorised Sunbed Hub administrators for account administration, identity verification, billing, fraud prevention, referral eligibility and legal compliance. They are not included in public or member-facing profiles, public search or structured data, public APIs, client bundles, messages, directory cards or certificates, and are not made available to another member. Please do not send identity documents or other sensitive information by email unless we have asked for it and explained a suitable way to provide it.

We may request reasonable evidence where information needs checking. A member of our team reviews identity decisions; Companies House or other public-register checks are manual unless we explicitly tell you an integration has been introduced. If you think information is wrong or a decision needs reconsideration, email hello@sunbedhub.co.uk. We will record the reason for a review decision and explain how to correct details or request a further review.

3.2 Staff Account Data

When a salon owner creates a staff profile, we may collect and store the following for each staff member:

• Staff member name
• Email address
• Job role or job title
• Linked salon and location
• Training activity (modules started, completed, time spent)
• Quiz results and scores
• Pass/fail records
• Certificates earned
• Activity history and login records
• Permission and access settings
• Account status (active, suspended, left)

Staff data is linked to the salon account and contributes to the salon's overall Compliance Score. Salon owners can view their staff records. Staff members can access their own profile and training history.

3.3 Supplier Registrations

When you register as a supplier, we collect:

• Company name and contact name
• Email address
• Phone number
• Business category and operating region
• Website and business description
• Logo (uploaded file)
• Historical billing references only, where required for accounting, dispute or audit records

3.4 Compliance Vault Documents

Salon members may upload documents to their Compliance Vault. These may include:

• Training certificates and proof of qualifications
• Insurance documents
• Risk assessment records
• Any other compliance or business documents you choose to upload

These documents are stored in private cloud storage and are not publicly visible. Access is limited to authorised users for your account and authorised Sunbed Hub administrators who need to review or support document handling. Our storage provider processes the files to provide the service, as described in the Data Sharing section below.

3.5 Compliance & Scoring Data

When you use our compliance tools, we collect and store:

• Uploaded document details: category, filename, upload date
• Document expiry dates and renewal dates entered by you
• Compliance status flags (current, expiring, expired, missing)
• Timestamped completion records for daily compliance checklists
• Equipment details and maintenance records
• UV lamp records and service history
• Compliance Score and Salon Score (platform-generated, based on the above)
• Staff-linked compliance and training contributions to the salon score

3.6 Multi-Location Data

Where an account manages linked salon locations, we may additionally collect:

• Individual location names and addresses
• Staff profiles linked to each specific location
• Location-level compliance documents and Vault records
• Location-level Compliance Scores

3.7 Training Records

When you or your staff complete training modules, we collect and store:

• Module completion status and scores
• Knowledge check answers and results
• Time spent reading each module
• Assessment pass/fail status and certificate records
• Date and time of completion

3.8 HubBot Conversations

When you use HubBot, our AI assistant, we store:

• Your messages and HubBot's responses
• Timestamps of each conversation
• Your user ID and role (to personalise responses)

HubBot conversation history is visible only to you and may be reviewed by our team for quality improvement purposes. You can clear your conversation history at any time from the HubBot page.

3.9 Payment and Membership Data

First-year membership for your first salon location is £219.99 plus VAT. Renewal and additional-location terms are confirmed separately before payment. Submitting a salon application itself does not take a payment; if payment is requested, the payment method, amount and VAT will be shown before you choose to pay. Checkout availability depends on payment-system readiness. Membership payments are manual and do not renew automatically. Sunbed Hub does not store your card details directly.

• We do not store card details directly
• Stripe customer, invoice, payment, refund or dispute identifiers may be retained where needed for accounting, membership access, refund, dispute or audit purposes
• Payment amounts, dates, VAT status, location tier and renewal dates may be retained for financial compliance and membership administration

3.10 Template Downloads

When members access or download templates:

• Template names and IDs accessed are recorded
• Date and time of download
• This helps us understand which resources are most valuable

3.11 Referral Programme Data

When you participate in our referral programme:

• Your unique referral code and any codes you used at signup
• Referral activity and rewards earned
• Qualifying signups attributed to your referral code
• Manual referral reward records (amount, date, recipient and admin status)
• Encrypted bank payout details only when you have an approved reward and choose to submit them
• Badges and achievements earned

Referral payout details are used only to administer approved manual bank-transfer rewards, are encrypted at application level, and are shown routinely only in masked form. Full details may be revealed only to authorised primary or super admins for an approved payment run and that access is audited. Retention is limited to the configured referral payout retention period and any longer period required for accounting, fraud prevention, dispute handling or legal obligations.

3.12 Community Content

• Your forum posts and replies are publicly visible to all logged-in members
• You can edit or delete your own posts at any time
• Post content, timestamps, and your username are stored

3.13 Job Postings & Applications

• Job listing details (title, description, location, contact email) are stored and publicly visible
• Job applications are stored and visible to the posting employer
• CVs uploaded as part of a job application are stored in secure private storage

3.14 Automatically Collected Information

• Browser type and version
• Operating system
• IP address (anonymised for analytics)
• Pages visited and time spent on pages
• Referring website
• Profile view and click analytics (for supplier profiles)

4. How We Use Your Information

4.1 Lawful Basis for Processing

• Contract Performance: To provide your membership, directory listing, training, compliance tools, and member services
• Legitimate Interest: To operate and improve the platform, prevent fraud, process referral commissions, and maintain compliance scoring records
• Consent: To send optional Sunbed Hub email marketing only if you have opted in; you can withdraw it through the unsubscribe link in any marketing email
• Legal Obligation: To retain financial records and other data as required by UK law

4.2 Specific Uses

• To create and manage your account and any associated staff accounts
• To display your public salon trading name, description, category and town or city in the directory; private legal identity and registration details are not displayed
• To build and display your compliance audit trail, Compliance Vault status, and Compliance Score
• To calculate staff and salon-level compliance scores based on training and document records
• To maintain historic financial, dispute and referral reward records where legally or operationally required
• To send transactional emails (account updates, password resets, expiry reminders, important notices)
• To send optional Sunbed Hub email marketing only with your consent; you can withdraw consent through the unsubscribe link in a marketing email. We retain a minimal suppression record to honour an opt-out.
• To calculate and pay referral commissions
• To review private legal or registration identity for account administration, billing, verification, fraud prevention, referral eligibility and legal compliance
• To review referrals fairly, distinguish confirmed connected businesses from independent businesses, and record the evidence and reason for a referral decision
• To personalise HubBot AI responses to your account role and context
• To prevent fraud and ensure platform security
• To improve our training content, templates, and platform features

5. Data Sharing and Disclosure

We do not sell your personal data.

Your legal name and company or registration number are private, not public listing information. Your salon trading name, description, category, approved profile content and town/city may be publicly visible and indexed by search engines. Contact details, street address and postcode are not part of the public salon listing. Private legal identity and registration details are not included in public responses, directory cards, search results, structured data, messages or certificates. Another member cannot view them; the authorised account holder can view their own private information in their settings, and authorised administrators may access it for the purposes explained above.

We may share your data with:

• Stripe: Payment, refund and dispute processing if a payment is made through Stripe
• Resend: Transactional and marketing email delivery
• OpenAI: Messages you submit to HubBot are sent to OpenAI's API to generate responses when you use that feature. Please avoid including information that is not needed for your question. Handling is subject to the provider terms and configuration in force when the feature is used.
• Google Cloud Storage: Private and public file storage (Compliance Vault, logos, CVs)
• Neon (PostgreSQL): Secure database hosting
• Legal Authorities: If required by law or to protect our legal rights

We use service providers to operate the platform, including Replit for application hosting, Neon for PostgreSQL database services, Google Cloud Storage for files, Resend for email, Google Analytics when configured and accepted, OpenAI when HubBot is used, and Stripe if and when a payment is processed. We share only the information needed for the relevant service. Each provider's role, terms and settings may change; we do not claim that all providers are located in the UK or that every provider has the same retention or data-use terms.

Insurance enquiries: If you separately choose to consent when submitting an insurance enquiry, the information you provide for that enquiry (which may include your contact, business and insurance-related details) is sent to Oak Insurance Brokers so they can respond to it. Without that separate consent, the enquiry is not sent to Oak. Oak handles any quote, advice or policy independently.

What is publicly visible (no login required):

• Salon directory listings: trading name, description, category, approved public profile content, and town/city only
• Job posting titles, descriptions, and locations (not contact emails)
• Supplier achievement badges and ratings

What is visible to verified members only:

• Email address, phone number, full address, website URL
• Location maps and full address details
• Job application contact details

6. Data Storage, Security & Retention

We use service providers to host and operate the application, database and file storage. Provider locations and available regional settings depend on the services configured for each provider; we do not guarantee that all data is stored only in the UK or EEA. We use security measures that include:

• Encrypted data transmission (HTTPS/TLS)
• Database hosting using Neon PostgreSQL
• Private and public object storage separation (Google Cloud Storage)
• Bcrypt password hashing (cost factor 12)
• Secure, signed session tokens (httpOnly cookies)
• Role-based access controls

6.1 Data Retention

We retain account data while needed to provide the service and for as long as your account is active, subject to the retention grounds below. To request account deletion, email hello@sunbedhub.co.uk; we review requests against legal, contractual, compliance, fraud-prevention and dispute-record requirements. We normally respond within one month, as required by applicable data-protection law, though that period may lawfully be extended where a request is complex or there are multiple requests.

The following categories of data may be retained or archived beyond the standard deletion window where necessary for platform integrity, legal obligations, dispute handling, fraud prevention, or legitimate business record purposes:

• Staff profiles and training records: May be archived rather than immediately deleted where they are linked to salon compliance history, certificates, or audit records
• Certificate records: Training completions, pass/fail history, and issued certificates may be retained
• Compliance history: Checklist completion records, Vault document history, and scoring data may be retained for audit purposes
• Financial and payment records: Generally retained for six years after the end of the relevant financial year, and longer where legally required or needed for a live dispute or other legal obligation
• Fraud prevention records: Retained as long as reasonably necessary

Where data is retained beyond a deletion request, it will be anonymised or restricted from active use where possible.

7. Automated Decision Making

We do not use automated decision making to make significant decisions about you. Compliance Scores and Salon Scores are platform-generated indicators based on data you enter. They are informational tools, not automated decisions that carry legal effect. Directory ranking is organic and does not use payment status, subscription tier, promotional status or boost status. All account approvals, content moderation, and referral reward decisions involve human review.

8. International Data Transfers

Some service providers may process or allow access to personal data from outside the UK. The location and transfer mechanism depend on each configured provider and the service used; we do not promise UK/EEA-only processing.

• Application hosting, database, file storage, email, analytics, AI and payment providers may process data in locations outside the UK, depending on their configuration and the relevant feature.

Where applicable data-protection law requires a safeguard for an international transfer, we will use a permitted transfer mechanism. Contact us at hello@sunbedhub.co.uk for current provider and transfer information.

9. Your Rights Under UK GDPR

You have the following rights regarding your personal data, subject to the limits and conditions in applicable law:

• Right to Access: Request a copy of all data we hold about you
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure ("Right to be Forgotten"): Request deletion of your data
• Right to Data Portability: Receive your data in a machine-readable format
• Right to Restrict Processing: Limit how we use your data
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Opt out of marketing communications at any time

To exercise any of these rights, please email us at hello@sunbedhub.co.uk. We normally respond within one month. The response period may be extended where data-protection law allows, including for complex or multiple requests.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

10. Cookies and Tracking

We use necessary session cookies and browser storage for platform functions. Google Analytics is loaded only when configured and after you accept optional analytics. You can change or withdraw that choice at any time using the control below.

See our Cookie Policy for full details.

11. Third-Party Links

Our website contains links to external websites (suppliers, partners, etc.). We are not responsible for the privacy practices of these third-party sites. Please review their privacy policies before sharing your data.

12. Children's Privacy

Our services are intended for businesses and professionals only. We do not knowingly collect data from individuals under 18 years of age.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or via a notice on our website. The "Last Updated" date at the top indicates when the policy was last revised.

14. Contact Us

For any questions, concerns, or data requests, please contact:

THE HUB COLLECTIVE LTD (trading as The Sunbed Hub)

Company number: 16874227

Registered office: The Courtyard, Holmbush Farm, Crawley Road, Faygate, Horsham, RH12 4SE

Email: hello@sunbedhub.co.uk