Privacy Policy

Last updated 6 October 2026.

The Lash Hub ("we", "us") runs this website and is the data controller for the personal data described here. We are based in Birmingham, United Kingdom. For anything to do with your data, email lashubuk@gmail.com.

What we collect

Orders and bookings: your name, email address, phone number, delivery and billing address, what you bought or booked, and the messages you send us about an order.
Account: your name, email address and password. Passwords are stored in a scrambled (hashed) form that we cannot read.
Payments: payments are taken by Stripe. We never receive your full card number. We keep the card type, the last four digits and the payment reference so we can match payments to orders and process refunds.
Reviews and enquiries: anything you write in a product review or the contact form.
Technical data: your IP address, browser and device type, and cookies as described in our Cookie Policy.

How we use it and why we are allowed to

To fulfil your order or booking (performance of a contract): taking payment, sending order and booking confirmations, delivering your items, providing downloads, handling returns and refunds, and running your account.
To meet our legal duties (legal obligation): keeping accurate accounting and tax records, and responding to lawful requests.
To run and protect the shop (legitimate interests): preventing fraud, keeping the site secure, fixing problems, and understanding how the shop is used so we can improve it. We balance these interests against your rights.
With your consent: analytics and marketing cookies, and any marketing emails you have opted in to. You can withdraw consent at any time.

We do not sell your personal data and we do not use it for automated decisions that have a legal or similarly significant effect on you.

Who we share it with

Stripe, which processes payments and protects against fraud.
Resend, which sends our order, booking and account emails.
Delivery carriers such as Royal Mail, who receive your name, address and contact details so they can deliver your order and send tracking updates.
Our hosting and postcode lookup providers, who store or process data only on our instructions.
Professional advisers and authorities where we are legally required to, or to protect our rights.

Some of these providers process data outside the UK. Where they do, we rely on safeguards recognised under UK data protection law, such as adequacy regulations or the UK International Data Transfer Agreement.

How long we keep it

Order, booking and payment records: six years after the end of the tax year they relate to, as required for accounting and tax.
Your account: until you ask us to delete it. We then remove your personal details and keep only anonymised order records.
Contact form messages: up to 12 months after we resolve your enquiry.
Reviews: while they are published on the site.
Security logs: for a short period, then deleted.

Your rights

Under UK data protection law you have the right to ask for a copy of your data, to have it corrected or deleted, to restrict or object to how we use it, to receive it in a portable format, and to withdraw any consent you have given. To use any of these rights, email lashubuk@gmail.com. We will reply within one month.

If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put things right first.

Children

Our products and classes are for adults. We do not knowingly collect data from anyone under 18.

Changes to this policy

We will update this page if how we use your data changes, and show the date of the latest version at the top.