This Privacy Policy explains how personal information is collected, used, and protected when you visit slxacademy.com, purchase products or services from us, or otherwise interact with SLX. slxnails.com remains an owned domain which redirects to slxacademy.com.

SLX operates through two related companies:

Together in this Privacy Policy, we refer to both companies as “SLX”, “we”, “us”, or “our”.

We are the data controller for the personal data we process about you. We are registered with the Information Commissioner’s Office (ICO).

For any questions about this policy or your personal data, contact us at admin@slxacademy.com.

We collect and process the following categories of personal information:

Information you provide directly

• Name and email address (when you join our waitlist, sign up for our newsletter, or make a purchase)
• Contact information including phone number (for retreat bookings, mentorship applications, and salon bookings)
• Postal or billing address (when required for purchases or invoicing)
• Payment card details (processed directly by Stripe; SLX never sees or stores full card numbers)
• Profile information you provide when joining SLX Collective or SLX Mentorship (professional background, business goals, portfolio links)
• Content you submit in course assignments, community posts, or feedback
• Application information for SLX Mentorship (business context, goals, expectations)
• Correspondence you send to us

Information collected automatically when you visit our website

• IP address and approximate geographic location
• Device type, operating system, and browser type
• Pages visited, time spent on pages, and referring website
• Interactions with our website (buttons clicked, forms started, purchase behaviour)
• Cookies and similar technologies (see our Cookie Policy)

Information collected from third parties

• Analytics data from Google Analytics 4 and Meta Pixel/Conversions API about your interaction with our site and our advertising

We process your personal data for the following purposes, each with a specific lawful basis under UK GDPR:

To provide our products and services (lawful basis: contract)

• Deliver purchased courses, community access, mentorship, and retreat services
• Process payments and issue receipts
• Provide customer support
• Fulfil our obligations to you under the Terms and Conditions

To communicate with you about your purchases (lawful basis: contract or legitimate interest)

• Send purchase confirmations, course access details, community invitations
• Send appointment reminders for retreats, mentorship sessions, or salon visits
• Notify you of important service updates or changes
• Respond to your enquiries

To send you marketing communications (lawful basis: consent, or soft opt-in for existing customers)

• Email you about new products, courses, retreats, and community content, only if you have explicitly opted in via our waitlist form, newsletter signup, or purchase checkout
• Send you SMS notifications about launches, retreat availability, or mentorship openings, only if you have explicitly opted in
• Personalise our marketing content based on your stated product interests and previous purchases

You can withdraw consent for marketing at any time by clicking “unsubscribe” in any email, replying STOP to any SMS, or emailing us at admin@slxacademy.com.

To improve our website and services (lawful basis: legitimate interest)

• Analyse how visitors use our site to improve performance and user experience
• Test different versions of pages, offers, and content to see what serves customers best
• Track conversion metrics to measure the effectiveness of our marketing
• Develop and improve our products based on customer feedback and behaviour

To retarget advertising (lawful basis: consent via cookies)

• Show you SLX advertising on Instagram, Facebook, or other platforms if you have previously visited our site
• Create “lookalike audiences” of people similar to our existing customers for advertising
• Measure the effectiveness of our advertising campaigns

This processing depends on your consent through our cookie consent banner. You can change your preferences at any time.

To meet legal and regulatory obligations (lawful basis: legal obligation)

• Comply with tax, accounting, and business record requirements
• Respond to lawful requests from regulators, courts, or law enforcement
• Prevent fraud and protect our legal rights

Automated decision-making

We may use automated systems to personalise communications with you. For example, sending different email content based on which SLX products you’ve expressed interest in, or triggering follow-up emails if you begin a purchase but do not complete it. These automated processes do not produce legal or similarly significant effects on you. You can opt out of automated marketing at any time.

We share your personal data only with the following categories of recipients, and only where necessary for the purposes described above:

Service providers who process data on our behalf (data processors)

Each of these providers is bound by a Data Processing Agreement (DPA) requiring them to protect your data and process it only on our instructions. Where providers are based outside the UK/EU, we ensure appropriate transfer safeguards are in place (Standard Contractual Clauses or equivalent).

We do not sell, rent, or share your personal data with third parties for their own marketing purposes. Our emails and communications are exclusively about SLX and our products. If we operate an affiliate programme in future, participation will be strictly opt-in and governed by separate terms.

Legal disclosures

We may disclose your personal data if required by law, court order, or lawful regulatory request; if necessary to protect our legal rights, property, or the safety of others; or in connection with a business sale, merger, or restructuring.

Some of our service providers are based outside the UK, notably in the United States and Canada. When we transfer your personal data outside the UK, we ensure adequate protection through:

• Standard Contractual Clauses or IDTA
• Adequacy decisions where applicable (e.g. EU/EEA)
• The UK-US Data Bridge (for providers certified under this framework)

You can request more details about our international transfer safeguards by contacting us.

We retain personal data only as long as necessary for the purposes described in this policy. Specific retention periods:

At the end of the retention period, we securely delete or anonymise your data.

You have the following rights over your personal data:

• Right of access: request a copy of the personal data we hold about you
• Right to rectification: correct inaccurate or incomplete data
• Right to erasure: request deletion of your personal data (“right to be forgotten”), subject to legal retention requirements
• Right to restriction of processing: limit how we use your data in certain circumstances
• Right to data portability: receive your data in a portable format
• Right to object: object to certain types of processing, including direct marketing
• Right to withdraw consent: where processing is based on consent, you can withdraw it at any time
• Rights related to automated decision-making: request human review of automated decisions affecting you
• Right to lodge a complaint: with the Information Commissioner’s Office (ICO) if you believe we have mishandled your data

To exercise any of these rights, contact us at admin@slxacademy.com. We will respond within one calendar month.

If you are not satisfied with our response, you can complain to the ICO:

• Website: ico.org.uk
• Helpline: 0303 123 1113

We use appropriate technical and organisational measures to protect your personal data, including:

• Encryption in transit (HTTPS) across all our websites and forms
• Encryption at rest for stored data (managed by our infrastructure and service providers)
• Access controls limiting personal data access to authorised personnel only
• Regular security reviews of our systems and third-party providers
• SOC 2, ISO 27001, or equivalent certifications from our critical infrastructure providers (Vercel, Stripe, GoHighLevel)
• Data Processing Agreements with all third-party processors
• A documented breach response procedure requiring notification to the ICO within 72 hours of any personal data breach

Despite these measures, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security but we take our obligations seriously.

Our website uses cookies and similar tracking technologies. Please see our separate Cookie Policy for full details on what we use and how you can control them.

Our services are intended for adults aged 16 and over. We do not knowingly collect personal data from anyone below 16 years old. If you believe we have inadvertently collected data from a child below 16 years old, please contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email (if we have your email address) or by prominent notice on our website. The “Last updated” date at the top of this policy indicates when it was last changed.

For any questions about this Privacy Policy, your personal data, or to exercise your rights, contact us:

• Email: admin@slxacademy.com
• Post: SLX Enterprises Ltd, 47 Southlands, Kirkham, PR4 2TR