This notice explains what personal data the Institute collects through the Portal, why, and what rights you have under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the rules made under it. The words “Portal”, “Portfolio Website”, “Content”, “Visitor” and “Policies” have the meaning given in the Terms and Conditions of Use (the “Terms”). “Intermediary Rules” means the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021. A Hindi version is available on request.
1. Who is responsible
UK International London Beauty School, First Floor, Plot No. A-4, A-5, Block A, Logix Park, Sector 16, Noida, U.P (“we”, the “Institute”) is the Data Fiduciary. You are the Data Principal. You can reach us at legal@uk-international.in and 9289926872.
2. Roles for Visitor data
For the details you give us (account, profile, photographs), we decide why and how they are used. For enquiries sent by Visitors through your Portfolio Website, you decide the purpose and we act only as your service provider (Data Processor), as Section 8 of the Terms states.
3. Personal data we collect and why
| Data | Examples | Purpose | Basis |
|---|---|---|---|
| Account data | Name, mobile number, email, batch or course, encrypted password | Create and secure your account, send OTPs and service messages | Consent |
| Portfolio data | Business or artist name, bio, city, address, service area, phone, WhatsApp, social links, services, prices, certificates, theme | Build and publish your Portfolio Website | Consent |
| Photographs and media | Photos and videos of your work, profile picture, logo | Show your work on your website | Consent |
| Technical data | IP address, device and browser, login times, pages used, cookie identifiers | Security, fraud prevention, fixing faults, basic statistics | Consent / legal obligation |
| Moderation records | Content flags, review notes, removal or blocking actions | Enforce the Policies and the law, handle complaints | Legal obligation / consent |
| Consent records | Policy version, ticks, date and time, IP address | Prove that consent was given or withdrawn | Legal obligation |
| Communications | Support requests, complaints, feedback | Respond to you and resolve grievances | Consent |
| Payment records | Amount, date, reference number, status (card or UPI details stay with the payment gateway) | Accounts, refunds and disputes | Consent / legal obligation |
| Marketing contact | Your contact details | Updates and offers, only if you tick box 3 on the consent page | Consent |
| Showcase | Your name, website and work | Promotion by the Institute, only if you tick box 4 on the consent page | Consent |
We collect only what is necessary for these purposes. Please do not upload Aadhaar, PAN, bank or other identity numbers to your Portfolio Website. We use your data for no other purpose without fresh consent or a legal basis.
4. Your consent
4.1 We process your data on your free, specific, informed, unconditional and unambiguous consent, given by a clear tick. Optional consents (boxes 3 and 4) do not affect your access to the Portal.
4.2 We may also process data without consent only for the “legitimate uses” in Section 7, such as complying with a law, a court order or a request of an authority.
4.3 You may withdraw consent at any time, as easily as you gave it, from Account > Delete my page on the Portal or by writing to the Data Protection Officer. Withdrawal does not affect processing already done. If you withdraw consent needed to run your website, we will take it offline and erase your data under Section 10 below, unless a law requires us to keep it.
5. What becomes public
Anything you put on your Portfolio Website, such as your name, phone number, address, location, photographs and links, is visible to anyone on the internet and may be copied, saved or indexed by search engines. Once public, we cannot control every copy. Publish only what you are comfortable making public. You can edit or remove it from your panel at any time.
6. Content monitoring
To enforce the Policies we scan Content with automated tools (for example, to detect nudity or unlawful material), and our authorised staff may review it. Staff access your Content only for support, moderation, security or legal reasons. We do not use your photographs or text to train artificial intelligence models, and we do not sell your data or use it for third-party advertising.
7. Photographs of other people
If you upload photographs or details of clients or models, you must first have their consent (Section 6 of the Terms). If someone tells us their image or data was published without consent, we will remove it promptly after verification.
8. Who we share data with
We do not sell personal data. We share it only with:
a) service providers (Data Processors) for hosting, cloud storage, SMS, WhatsApp and email, analytics, payment processing and technical support, under a valid contract that requires security safeguards and use only on our instructions. We stay responsible for compliance even where a processor handles the data;
b) courts, police, regulators and government authorities where the law requires;
c) a buyer or successor, if the Institute’s business is restructured or transferred, with the same protection for your data;
d) the public, to the extent of what you choose to publish.
On request we will tell you the identities of the Data Fiduciaries and Processors we have shared your data with, and describe the data shared.
9. Storage and transfers outside India
Your data is stored on servers in the United States (our hosting provider, Hostinger). We transfer data outside India only to countries the Central Government has not restricted under the DPDP Act.
10. Retention and erasure
- Active account: we keep your data while your account is active.
- After you withdraw consent or close your account: we erase your data, and make our processors erase it, within 30 days, unless a law requires us to keep it.
- Logs and records: we keep traffic and access logs for at least one year, as the DPDP Rules require. We keep consent, moderation and takedown records for 3 years for legal defence and compliance.
- Backups are overwritten in the normal cycle.
11. Security and breach
We use reasonable security safeguards, including encryption of passwords, access control, secure connections (HTTPS), activity logs, backups and staff confidentiality duties. If a personal data breach affects you, we will inform you and the Data Protection Board of India as the DPDP Act and Rules require. No system is completely secure.
12. Accuracy
You are responsible for keeping your data accurate. We may ask you to verify details that appear wrong or incomplete.
13. Children
The Portal is meant for persons aged 18 and above. A “child” is a person under 18. Before processing a child’s data we require verifiable consent of the parent or lawful guardian, collected through OTP verification and the confirmation of the parent or guardian. We do not process a child’s data in a way that harms the child’s well-being, and we do not track or monitor the behaviour of children or direct advertising at them. A parent or guardian who believes a child’s data was provided without consent should contact us at once and we will act.
14. Your rights
a) Access: a summary of the personal data we process and our processing activities, the identities of all Data Fiduciaries and Processors we have shared it with, and a description of the data shared;
b) Correction, completion, updating and erasure: of data that is inaccurate, incomplete, outdated or no longer needed;
c) Grievance redressal: to have your complaint heard by us first, and then to complain to the Data Protection Board of India if you are not satisfied;
d) Nomination: to name another person to exercise your rights if you die or become incapacitated;
e) Withdraw consent at any time.
Send a request from your panel or to the Data Protection Officer. We may verify your identity first. We aim to respond within 30 days and, in any case, within the maximum period the DPDP Rules prescribe. Your own duties under Section 15 of the DPDP Act are in Section 3.3 of the Terms.
15. Data Protection Officer and Grievance Officer
- Data Protection Officer: ANKIT KHATRI
- Address: First Floor, Plot No. A-4, A-5, Block A, Logix Park, Sector 16, Noida, U.P
- Email: legal@uk-international.in | Phone: 9289926872 (Mon to Fri, 10:00 am to 5:00 pm)
We acknowledge complaints within 24 hours and aim to resolve them within 15 days. Complaints about nudity or private images are acted on within the shortest time the Intermediary Rules prescribe. Please approach the Data Protection Board of India only after using this process.
16. Cookies
See our separate Cookie Policy.
17. Changes
We will tell you when this notice changes. For material changes we will ask for your consent again.