Master the Facial Danger Zones
Download your free expert guide to safer, more confident aesthetic injecting.
Cole Aesthetics Academy · Legal
Privacy Policy
This policy explains what personal information we collect when you use Cole Aesthetics Academy, why we collect it, who we share it with, and the rights you have over it under UK data protection law.
Last updated: 7 August 2026
01
Who we are and who is responsible
Cole Aesthetics Academy is an online education platform providing continuing professional development for people already qualified or working in medical aesthetics. The platform is operated by Steven Cole and is based in the United Kingdom. Our website is coleaestheticsacademy.com.
For the purposes of the UK GDPR and the Data Protection Act 2018, we are the data controller for the personal information described in this policy. That means we decide what information is collected and what it is used for.
If you have any question about how we handle your information, contact us at [email protected].
02
What this policy covers
This policy applies to information we collect when you visit our website, create an account, purchase a course, complete an assessment, download a free resource, subscribe to our emails, or contact us.
It does not cover other websites we link to. If you follow a link away from our site — for example to a payment provider, a form we host elsewhere, or a social media platform — that organisation’s own privacy policy applies to what happens there.
03
Information you give us
Most of the information we hold is information you provide directly:
- Account details — your name, email address, username and password.
- Purchase details — the courses you buy, the amount paid, billing name and billing address.
- Professional details — your qualifications or experience, where you tell us, so we can confirm a course is appropriate for you.
- Assessment answers — the written responses you submit for each course assessment.
- Enquiries and correspondence — anything you send us by email, contact form or social media, including complaints.
- Free resource requests — your name and email when you download a guide or join a mailing list.
04
Information we collect automatically
When you use the website, some information is collected automatically by our systems and by the services we use to run the site:
- Technical data such as your IP address, browser type, device type and operating system.
- How you use the site — pages viewed, links clicked, time spent, and the site you arrived from.
- Your progress through a course, including which lessons you have opened and completed.
- Cookies and similar technologies. These are explained in full in our Cookie Policy.
We do not use this information to try to identify you personally. It helps us keep the platform working, spot problems, and understand which courses and pages are useful.
05
Information we do not collect
We do not ask for and do not want clinical information about your patients. Please do not send us patient records, patient photographs, or any information that could identify a patient — including in assessment answers, emails or support requests.
If you send us patient-identifiable information, we will delete it and ask you not to send it again.
We do not store your card or bank details. Payments are handled directly by our payment providers.
06
Why we use your information, and our lawful basis
Under UK data protection law we must have a lawful basis for using your information. Ours are set out below.
- To give you access to a course you have bought, mark your assessment and issue your certificate — performance of our contract with you.
- To take payment and keep financial records — performance of our contract, and our legal obligation to keep tax records.
- To record CPD completion and issue Open CPD credits — performance of our contract with you.
- To answer your enquiries and handle complaints — our legitimate interest in running the Academy properly.
- To keep the platform secure and prevent misuse or account sharing — our legitimate interest in protecting our content and our learners.
- To improve our courses and website — our legitimate interest in understanding how the platform is used.
- To send marketing emails about courses and resources — your consent, or our legitimate interest where you are an existing customer and we are telling you about similar courses.
- To send browser push notifications — your consent, given when you allow notifications in your browser.
- To meet legal and regulatory obligations — compliance with a legal obligation.
07
Marketing and push notifications
You are always in control
You can stop marketing emails at any time using the unsubscribe link at the bottom of any email, or by emailing us. Push notifications can be switched off in your browser settings at any time, and you can decline them when first asked.
Opting out of marketing does not affect emails we must send you about a course you have purchased — such as your login details, assessment result or certificate. Those are part of the service you paid for.
Opting out of marketing does not affect emails we must send you about a course you have purchased — such as your login details, assessment result or certificate. Those are part of the service you paid for.
08
Who we share your information with
We do not sell your personal information, and we do not share it for other organisations’ marketing.
We do share it with the service providers that make the Academy work. Each is only given what it needs, and each is required to keep it secure and use it only on our instructions:
- Website hosting — the provider that stores our website and its database.
- Payment providers — to take payment securely and handle any chargeback or dispute.
- Our learning platform and website plugins — to deliver courses, run assessments and manage your account.
- Email and marketing tools — to send transactional and marketing emails.
- Analytics and performance tools — to understand how the website is used.
- CPD accreditation — where a record of completion is needed to issue your CPD credits.
- Professional advisers — such as accountants, where necessary.
We may also disclose information where we are required to by law, by a regulator, or by a court, or where it is necessary to establish or defend a legal claim.
09
Where your information is stored
We aim to keep your information within the United Kingdom or the European Economic Area wherever we can. Some of the providers we rely on operate internationally, so your information may be transferred outside the UK.
Where that happens, we take steps to make sure it is protected to a standard equivalent to UK law — for example by relying on UK adequacy regulations, or by putting the International Data Transfer Agreement or Addendum in place with that provider.
10
How long we keep your information
We keep information only for as long as we need it:
- Account and course access records — while your account is active, and for a reasonable period afterwards.
- Assessment answers and certificate records — retained so we can verify a certificate or CPD record if you or an employer asks us to.
- Purchase and payment records — kept for at least six years, as UK tax law requires.
- Enquiries and complaints — kept for a reasonable period after the matter is closed.
- Marketing contacts — until you unsubscribe, and a short period afterwards so we can honour your opt-out.
11
Keeping your information secure
We use appropriate technical and organisational measures to protect your information, including encrypted connections to our website, access controls on accounts and administrative systems, and providers who maintain their own security standards.
No online service can be completely secure. Please help by using a strong, unique password, not sharing your login, and telling us promptly if you think your account has been accessed by someone else.
12
Your rights
Under UK data protection law you have the following rights, free of charge:
- Access — ask for a copy of the personal information we hold about you.
- Correction — ask us to correct anything inaccurate or incomplete.
- Erasure — ask us to delete your information, where we have no ongoing reason to keep it.
- Restriction — ask us to pause how we use your information while a concern is resolved.
- Objection — object to us using your information on the basis of legitimate interests, and object to direct marketing at any time.
- Portability — ask for the information you gave us in a portable electronic format.
- Withdraw consent — where we rely on your consent, withdraw it at any time.
To exercise any of these, email [email protected]. We will respond within one month. We may need to confirm your identity first, so that we do not disclose your information to someone else.
Please note that deleting your account will end your access to any course you have purchased, and no refund is due in those circumstances. We may also need to keep some records — such as payment records — even after a deletion request, where the law requires it.
13
Children
Our courses are intended for adult professionals. The platform is not designed for and should not be used by anyone under 18, and we do not knowingly collect information about children.
If you believe a child has provided us with personal information, contact us and we will delete it.
14
Changes to this policy
We review this policy regularly and will update it when our practices change or when the law changes. The date at the top of the page shows when it was last revised.
Where a change is significant, we will tell you by email or by a notice on the website.
15
Complaints
If you are unhappy with how we have handled your personal information, please tell us first at [email protected] — we would like the chance to put it right.
Questions about this policy?
If anything here is unclear, or you need this information in another format, get in touch and we will help.
Online continuing professional development for qualified aesthetic practitioners — led by Steven Cole, Level 7 Advanced Aesthetics Practitioner and Business Development Coach.
Our courses are theory-based online learning intended to extend existing knowledge. They are not a substitute for hands-on, supervised clinical training, and completion does not confer any licence or authority to perform treatments. Practitioners remain responsible for working within their own scope of practice, insurance and regulatory requirements.
Copyright © 2024-2026
