Privacy policy
GHOSTBOND Academy — Privacy and Data Collection Policy
Version 1.0 | Issued: 6 September 2026 | Effective from: 6 September 2026
1. Introduction
1.1 GHOSTBOND Academy is committed to handling personal information lawfully, fairly, transparently and securely.
1.2 This Policy explains what personal information we collect, why we collect it, the legal bases on which we rely, who we share it with, how long we keep it, and the rights available to you.
1.3 It applies to the GHOSTBOND Academy website, platform, courses, events, community features and related communications.
2. Who Is Responsible for Your Personal Information
2.1 The data controller depends on where you are located:
(a) European Economic Area, United Kingdom, Switzerland and all other territories except those at 2.1(b):
Professional Hair Products Limited Registered in Ireland, company registration number 497664 Registered office and place of business: Scientific Cosmetix Business Park, Whitemill Industrial Estate, Wexford, Y35 X0TK, Ireland Telephone: +353 53 91 78582
(b) United States, Canada, Mexico and the Caribbean:
Scientific Cosmetix LLC A Florida limited liability company, Florida document number L21000294469 Registered office and place of business: 3795 Correia Drive, Zephyrhills, Florida 33542, United States Telephone: +1 813 788 7468
2.2 The two entities act as joint controllers for the limited purposes of operating the shared Academy platform, shared customer records and group-level marketing. An arrangement under Article 26 GDPR sets out their respective responsibilities; the essence of that arrangement is available on request. Regardless of the arrangement, you may exercise your rights against either entity, and Professional Hair Products Limited will act as the single point of contact for data subjects in the EEA and UK.
2.3 Data Protection contact: [PRIVACY EMAIL — e.g. privacy@ghostbondacademy.com]
3. Categories of Personal Information We Collect
3.1 Identity and contact information — name, email address, telephone number, billing address, delivery address, country, business or salon name.
3.2 Account information — username, hashed authentication credentials, account settings, preferences, language.
3.3 Purchase and transaction information — courses and events purchased, order history, order value, payment status, refunds, credits, discount codes and invoices. Complete payment card details are processed by our payment providers and are not stored by us.
3.4 Learning information — enrolments, lessons viewed, progress, playback position, completion status, assessment results, downloads, certificates issued and certificate numbers.
3.5 Community information — questions, comments, forum posts, portfolio images, before-and-after work and other material you choose to submit.
3.6 Event information — registrations, attendance, dietary requirements where you supply them, kit and model details, venue communications.
3.7 Health and accessibility information (special category data) — where you voluntarily tell us about a disability, accessibility requirement, allergy or medical condition relevant to your safe participation in practical training, or a dietary requirement that reveals health or religious information. We process this only with your explicit consent, or where necessary to protect your or another person’s vital interests, and only to the extent necessary. You are never obliged to provide it, but we may be unable to accommodate a requirement we do not know about.
3.8 Communications — emails, support tickets, enquiries, refund requests, complaints, feedback and survey responses.
3.9 Technical and usage information — IP address, device identifiers, browser and operating system, referring pages, pages viewed, session duration, login timestamps, and information collected via cookies and similar technologies.
3.10 Anti-piracy and account security information — concurrent session data, device counts, geographic access patterns and forensic watermark identifiers embedded in course playback. This is used to detect credential sharing and unauthorised distribution of course content.
3.11 Marketing information — your preferences, consent records, email opens and clicks, and engagement with advertising.
3.12 Images, video and recordings — photographs and video captured at in-person events, and recordings of live online sessions.
4. Where We Obtain Personal Information
4.1 Directly from you — on registration, purchase, event booking, community participation or contact.
4.2 Automatically — through your use of our website and platform, and through cookies and similar technologies.
4.3 From service providers — payment, hosting, course delivery, analytics, marketing, customer support and fraud prevention providers.
4.4 From the other Professional Hair Labs Group entity identified at clause 2.1, where lawful and necessary.
4.5 From educators, venues, distributors and event partners where you registered through them.
4.6 From your employer or training provider, where they have purchased Academy seats on your behalf. In that case they are responsible for informing you and for having a lawful basis to share your details with us.
5. Purposes and Legal Bases
Where the GDPR, UK GDPR or equivalent law applies, we rely on the following legal bases.
| Purpose | Categories used | Legal basis |
|---|---|---|
| Create and administer your account | 3.1, 3.2 | Contract |
| Supply courses, memberships and events | 3.1–3.4, 3.6 | Contract |
| Process payments, refunds and credits | 3.1, 3.3 | Contract; legal obligation |
| Track progress and issue certificates | 3.4 | Contract |
| Operate community and Q&A features | 3.5 | Contract; legitimate interests |
| Customer service and complaint handling | 3.1, 3.3, 3.8 | Contract; legal obligation |
| Accessibility and safe participation | 3.7 | Explicit consent (Art. 9(2)(a)); vital interests |
| Detect fraud, credential sharing and content piracy | 3.2, 3.9, 3.10 | Legitimate interests (protecting our intellectual property, revenue and platform integrity) |
| Platform security and abuse prevention | 3.2, 3.9 | Legitimate interests; legal obligation |
| Improve and develop Academy content and UX | 3.4, 3.9 | Legitimate interests |
| Analytics and audience measurement | 3.9 | Consent (where cookies are used) |
| Marketing email and advertising | 3.1, 3.11 | Consent; legitimate interests for existing customers where permitted |
| Event photography and recording | 3.12 | Legitimate interests for internal and expected event use; consent for promotional use |
| Accounting, tax and statutory records | 3.1, 3.3 | Legal obligation |
| Establish, exercise or defend legal claims | Any relevant | Legitimate interests; legal obligation |
| Corporate transactions | Any relevant | Legitimate interests |
5.2 Where we rely on legitimate interests, we have carried out a balancing assessment and concluded that our interests are not overridden by your rights and freedoms. You may request further information about that assessment, and you may object under clause 12.
5.3 Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.
6. Marketing Communications
6.1 We may send you information about Academy courses, events, webinars and relevant GHOSTBOND products.
6.2 We send marketing email on the basis of your consent, or — where you have purchased from us and applicable law permits — on the basis of the existing customer relationship, in each case with a clear opt-out in every message.
6.3 You may unsubscribe at any time using the link in any marketing email, through your account preferences, or by contacting us.
6.4 Every marketing email identifies the sending entity and carries its physical postal address: marketing sent by Professional Hair Products Limited carries the Wexford address, and marketing sent by Scientific Cosmetix LLC carries the Zephyrhills address, in each case with a functioning unsubscribe mechanism.
6.5 Opting out of marketing does not stop transactional and service messages relating to your purchases, account, course or event, which we must send to perform the contract.
6.5 We do not sell your personal information to third parties for their own independent marketing.
7. Cookies and Similar Technologies
7.1 We use cookies, pixels, SDKs, local storage and similar technologies. Full details, including a table of the cookies we set, are in the Cookie Policy.
7.2 Non-essential cookies — functional, analytics and advertising — are set only after you have given consent through our cookie banner, in accordance with the ePrivacy rules applicable in your jurisdiction.
7.3 You can change or withdraw your choices at any time via the Cookie Preferences link in the website footer.
7.4 Where supported and legally applicable, we recognise the Global Privacy Control signal as a valid opt-out of the sale or sharing of personal information and of targeted advertising.
8. Service Providers and Recipients
8.1 We share personal information with service providers who process it on our instructions under a written data processing agreement:
| Function | Category of recipient |
|---|---|
| Ecommerce and website platform | Shopify Inc. and its sub-processors |
| Payment processing | [PAYMENT PROVIDERS] |
| Learning management and course delivery | [LMS PROVIDER] |
| Video hosting and streaming | [VIDEO PROVIDER] |
| Webinars and live sessions | [WEBINAR PROVIDER] |
| Email and marketing automation | [ESP] |
| Analytics | [ANALYTICS PROVIDER] |
| Advertising and measurement | [AD PLATFORMS] |
| Customer support and helpdesk | [HELPDESK PROVIDER] |
| Cloud hosting and storage | [HOSTING PROVIDER] |
| Fraud prevention and security | [SECURITY PROVIDER] |
| Shipping and fulfilment | [CARRIERS] |
| Accounting and tax | [ACCOUNTING PROVIDER] |
8.2 Shopify. Core parts of our website and ecommerce infrastructure are provided by Shopify Inc. Information you submit through the Academy website is processed by Shopify and its service providers, which may involve processing in Canada, the United States and other countries. Shopify’s own privacy terms are available at shopify.com/legal/privacy.
8.3 Educators, venues and event partners. We share only the registration information reasonably required for them to deliver your class or event — typically name, contact details, booking reference and any accessibility or safety information you have consented to us sharing.
8.4 Group companies. Information may be shared between the two Professional Hair Labs Group entities identified at clause 2.1 — Professional Hair Products Limited and Scientific Cosmetix LLC, which are the only entities that operate GHOSTBOND Academy — where necessary to provide Academy Services, operate the business, provide support, maintain security or carry out lawful marketing.
8.5 Legal and business disclosures. We may disclose information where reasonably necessary to comply with law; respond to a lawful request from a court, regulator or public authority; investigate fraud or a security incident; protect users, the public or our business; enforce our Terms; or complete a merger, acquisition, restructuring, financing or sale of assets.
9. International Transfers
9.1 We operate internationally, and your personal information may be processed outside your home country, including in the United States.
9.2 Where personal information protected by EU or UK data protection law is transferred outside the EEA or UK, we rely on an appropriate transfer mechanism, which may include:
- an adequacy decision of the European Commission or the UK Government;
- the EU Standard Contractual Clauses, and for UK transfers the UK International Data Transfer Addendum or IDTA;
- certification under the EU–US Data Privacy Framework or its UK Extension, where the recipient is certified.
9.3 We carry out transfer impact assessments where required and apply supplementary technical and organisational measures where appropriate.
9.4 You may request a copy of the safeguards applied by contacting us.
10. Retention
10.1 We keep personal information only as long as necessary for the purpose for which it was collected and to meet legal, contractual, accounting and regulatory obligations.
| Record type | Indicative retention |
|---|---|
| Account and profile data | For the life of the account, then 24 months after closure |
| Course enrolment and progress records | Duration of access period, then 24 months |
| Certificate records | 7 years from issue (to allow verification and revocation) |
| Order, invoice, tax and accounting records | 6 years (Ireland/UK) / 7 years (US), from end of the relevant tax year |
| Consent and cancellation-acknowledgement records | 6 years from the end of the contract |
| Customer service and complaint records | 3 years from closure of the matter |
| Marketing consent and preference records | Until withdrawal, plus a permanent suppression record so your opt-out is respected |
| Event photography and recordings | 3 years, or until consent is withdrawn where consent is the basis |
| Anti-piracy and security logs | 12 months, or longer where required for an active investigation or claim |
| Cookie and analytics data | As stated in the Cookie Policy |
10.2 Where a legal claim, investigation or regulatory matter is live or reasonably anticipated, we retain relevant records until it is resolved.
10.3 At the end of a retention period, information is deleted or irreversibly anonymised.
11. Security
11.1 We apply appropriate technical and organisational measures, including encryption in transit, access controls on a least-privilege basis, hashed credential storage, logging and monitoring, staff confidentiality obligations and supplier due diligence.
11.2 No internet-based service can guarantee absolute security. You are responsible for keeping your Academy credentials confidential and for not sharing your account.
11.3 In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours where required, and will notify you without undue delay where the breach is likely to result in a high risk to you.
12. Your Rights
12.1 Depending on where you live, you may have the right to:
- access the personal information we hold about you and receive a copy;
- rectify inaccurate or incomplete information;
- erase information in certain circumstances;
- restrict processing in certain circumstances;
- object to processing based on legitimate interests, and to object at any time to direct marketing;
- portability — receive information you provided in a structured, commonly used, machine-readable format and have it transmitted to another controller where technically feasible;
- withdraw consent at any time;
- opt out of the sale or sharing of personal information, of targeted advertising, and of certain profiling, where applicable law provides that right;
- not be discriminated against for exercising a privacy right;
- appeal a decision we make on your request, where applicable law provides an appeal right; and
- lodge a complaint with a supervisory authority.
12.2 How to exercise a right. Email hello@ghostbondacademy.com or write to the address in clause 2. Requests are free of charge. We may charge a reasonable fee or refuse a request that is manifestly unfounded or excessive, and will explain why.
12.3 Verification. We may ask you to verify your identity before acting on a request. Where you use an authorised agent, we may require proof of authorisation.
12.4 Timescales. We respond within one month under the GDPR and UK GDPR, extendable by two further months for complex requests, and within 45 days under applicable US State laws, extendable by a further 45 days. We will tell you if we need an extension.
13. EEA and UK Users
13.1 If you are in the EEA or UK you have the rights at clause 12 under the GDPR or UK GDPR.
13.2 You may lodge a complaint with your national supervisory authority. Individuals in Ireland may contact the Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland — dataprotection.ie. Individuals in the UK may contact the Information Commissioner’s Office — ico.org.uk.
13.3 We would appreciate the chance to resolve your concern first.
14. United States Privacy Rights
14.1 Residents of certain US States — including California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon and others — may have rights to know, access, correct, delete, obtain a portable copy, limit the use of sensitive personal information, and opt out of the sale or sharing of personal information, targeted advertising and profiling with significant effects, where the applicable statute applies to us.
14.2 Sale and sharing. We do not sell personal information for money. However, where advertising and analytics cookies are enabled, the disclosure of identifiers and browsing activity to advertising partners may constitute a “sale” or “sharing for cross-context behavioural advertising” under California and similar laws. You can opt out at any time using the “Do Not Sell or Share My Personal Information” link in our website footer, through the Cookie Preferences tool, or by transmitting a Global Privacy Control signal.
14.3 Sensitive personal information. We do not use or disclose sensitive personal information for purposes other than those permitted without an opt-out under applicable law. Where you supply health or accessibility information under clause 3.7, it is used only for the purpose you provided it.
14.4 Notice at collection. The categories of personal information we collect, the purposes, and the categories of recipients are described in clauses 3, 5 and 8. The retention criteria are in clause 10.
14.5 Appeals. If we decline your request, you may appeal by replying to our response or emailing hello@ghostbondacademy.com with “Privacy Appeal” in the subject line. We will respond within the period required by your State’s law and, where applicable, provide details of how to contact your State Attorney General.
15. Photography, Video and Recordings
15.1 In-person events. We may take photographs and video at Academy events. Signage will be displayed at the venue and notice given at registration. If you do not wish to be photographed, tell the event team on arrival and we will take reasonable steps to accommodate you.
15.2 Live online sessions. Live sessions may be recorded. You will be told before recording begins. Where a session includes participant cameras or Q&A, your image, name and questions may be captured.
15.3 Promotional use. Where we wish to use identifiable images or recordings of you in advertising or promotion beyond what a participant would reasonably expect from the event, we will obtain your separate written consent, which you may withdraw at any time. Withdrawal does not require us to recall material already distributed, but we will cease further use.
15.4 Models. Where a model is used in training, the Model Release and Consent Form applies.
16. Children
16.1 The Academy is a professional education service intended for adults. Accounts and purchases are restricted to persons aged 18 or over, save for the limited apprenticeship exception at clause 4.2 of the Terms and Conditions.
16.2 We do not knowingly collect personal information from children. In Ireland, the age of digital consent is 16; in the United States, we do not knowingly collect personal information from children under 13 in breach of COPPA.
16.3 If you believe a child has provided personal information to us, contact hello@ghostbondacademy.com and we will delete it promptly.
17. Automated Decision-Making and Profiling
17.1 We do not make decisions producing legal or similarly significant effects about you based solely on automated processing.
17.2 We use limited automated analysis for fraud prevention, credential-sharing detection and marketing segmentation. Where an automated signal indicates account sharing or piracy, any decision to suspend or terminate an account involves human review, and you may contest the decision under clause 20 of the Terms and Conditions.
18. Third-Party Sites
18.1 Our website may link to third-party sites and services. We are not responsible for their privacy practices. Review their policies before providing personal information.
19. Changes to This Policy
19.1 We may update this Policy when our services, technology, suppliers or legal obligations change.
19.2 The current version is published on the Academy website with a version number and revision date. Where a change is material, we will give notice by email or by a prominent notice on the site before it takes effect.
20. Contact
Privacy enquiries and rights requests: hello@ghostbondacademy.com General support: hello@ghostbondacademy.com
Ireland Professional Hair Products Limited Registered in Ireland, company registration number 497664 Registered office and place of business: Scientific Cosmetix Business Park, Whitemill Industrial Estate, Wexford, Y35 X0TK, Ireland Telephone: +353 53 91 78582
United States Scientific Cosmetix LLC A Florida limited liability company, Florida document number L21000294469 Registered office and place of business: 3795 Correia Drive, Zephyrhills, Florida 33542, United States Telephone: +1 813 788 7468