Privacy policy

Last updated: 6 September 2026

1. Who controls your information

BEAUTYBOOST LTD is the controller of personal information processed through koreanlashlift.co.uk.

BEAUTYBOOST LTD
Evagora Pallikaridi 38
8010 Paphos
Cyprus
Company registration number HE466648
VAT registration number CY60108765J
Email hello@koreanlashlift.eu

This notice applies to store visitors, customers, account and course users, people who contact support or submit a return, marketing subscribers, product-availability subscribers, affiliate applicants and business contacts.

2. Information we collect

Depending on how you use the store, we collect:

identity and contact information, including name, email address, telephone number, billing and delivery address;
order and transaction information, including products, prices, discounts, VAT, payment status, delivery status, returns and communications;
account and course information, including login identifiers, enrolment, access, lesson and assessment activity, completion and certificate records;
business and professional information, including salon or company name, role, VAT information, professional purchasing status and affiliate information;
support, return and product-safety information, including messages, photographs, video, batch data, treatment information and troubleshooting records you choose to submit;
marketing information, including subscriptions, preferences, consent, opt-out and campaign interaction records;
technical and usage information, including IP address, device and browser details, cookie or similar-technology identifiers, pages viewed, referral source, cart events, security logs and fraud signals; and
information created by us, including customer-service notes, risk flags, account status and evidence needed to establish, exercise or defend legal claims.

Payment card or wallet credentials are normally collected directly by the selected payment provider. We receive payment status, transaction identifiers and limited fraud or account information rather than full card credentials.

Do not send special-category information, such as detailed medical information, unless it is genuinely necessary for a product-safety or support request. If you send photographs or treatment information about another person, you must have a lawful basis and any permission needed to provide it.

3. How we obtain information

We obtain information directly from you when you browse, order, create an account, access a course, subscribe, contact us, submit a claim or apply as an affiliate. We also receive information from payment providers, Royal Mail and fulfilment services, fraud and security providers, analytics and advertising providers, affiliates that referred a transaction, and our ecommerce, course and communications systems.

For business contacts, we may obtain professional information from the business you represent or from public business sources. If we receive personal information from another source, we provide the information required by law within the applicable period unless an exception applies.

4. Why we use information and our lawful bases

We use personal information only where a lawful basis applies.

Orders and pre-contract requests. We use identity, contact, order, payment-status and delivery information to take requested steps, accept and fulfil orders, provide invoices, deliver goods, administer returns and give support. The basis is performance of a contract or steps requested before a contract.

Accounts and courses. We create and secure accounts, provide course access, record progress, administer assessments and certificates, and enforce the personal course licence. The basis is contract. Security and misuse controls also rely on our legitimate interests in protecting paid content, customers and the store.

Tax, accounting, product safety and compliance. We keep and disclose records where required for tax, accounting, product traceability, recalls, sanctions, consumer protection, court orders and regulatory requests. The basis is legal obligation. Where a non-UK duty does not qualify as a UK GDPR legal obligation, we rely where appropriate on legitimate interests in lawful operation and claims management.

Fraud, payment and security. We use transaction, device, address and account information to authenticate users, detect fraud, prevent abuse, investigate chargebacks, secure the store and enforce terms. The basis is legitimate interests and, where applicable, legal obligation. We balance those interests against individual rights and limit access to those who need it.

Customer service, returns and claims. We use communications and submitted evidence to answer requests, diagnose product issues, process returns, protect safety and establish, exercise or defend claims. The basis is contract, legal obligation and legitimate interests, depending on the request.

Store operation and improvement. We use technical and aggregated usage information to maintain functionality, understand performance, diagnose errors and improve the customer journey. Strictly necessary processing relies on contract or legitimate interests. Non-essential analytics or tracking relies on consent where the law requires it.

Marketing. We send marketing where you consent or where the electronic-mail soft opt-in lawfully applies to our own similar products and services. We give an opt-out when details are collected where required and in every marketing message. We use consent or legitimate interests under data-protection law as appropriate, together with the separate requirements of the Privacy and Electronic Communications Regulations. You can object or unsubscribe at any time.

Business and affiliate relationships. We assess affiliate applications, manage referrals and commissions, and communicate with business customers and professional contacts. The basis is contract, requested pre-contract steps and legitimate interests in operating business relationships.

5. Information you must provide

Information marked as required at checkout, account registration or a support process is needed to enter or perform the contract, meet a legal duty, deliver the order, secure the account or investigate the request. If you do not provide it, we may be unable to accept the order, deliver goods, provide course access or determine a claim. Marketing information is optional and is not a condition of purchase.

6. Service providers and other recipients

We share only the information reasonably needed for the relevant function. Recipients may include:

ecommerce and website providers, including WordPress, WooCommerce and hosting, cache, security and technical-support providers;
checkout and payment providers selected or presented at checkout, which may include Stripe, PayPal and Mollie services;
Royal Mail, our Aylesbury fulfilment operation, shipment-tracking and address or delivery service providers;
LearnPress and related course technologies used to provide training access and records;
email, transactional messaging and marketing providers, including Zoho ZeptoMail and Klaviyo where enabled;
analytics, advertising, product-feed and conversion-measurement providers, including services configured through Pixel Manager, where enabled and permitted by your choices;
Cloudflare Turnstile and other fraud, bot-prevention and security providers;
JTL and other inventory, order-management, export, affiliate, back-in-stock and customer-service tools used in store operations;
accountants, legal advisers, insurers, auditors, payment-dispute services and prospective purchasers of all or part of the business under confidentiality safeguards; and
courts, regulators, tax authorities, law enforcement or other recipients where disclosure is required or lawful.

Some providers act as independent controllers for their own purposes, particularly payment and delivery providers. Their notices apply to that processing. We do not sell personal information.

7. International transfers

BEAUTYBOOST LTD is established in Cyprus and the store serves the United Kingdom. Our providers may process information in the United Kingdom, European Economic Area, United States and other countries.

Where a restricted transfer requires protection, we use an applicable UK adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another lawful mechanism. We also assess supplementary measures where required. Contact us if you want information about the safeguard relevant to a particular transfer, subject to lawful confidentiality limits.

8. Marketing and tracking choices

Marketing emails and texts identify the sender and include a valid way to unsubscribe. Service messages about an order, payment, delivery, safety, account security, course access or an existing request are not marketing and may still be sent when needed.

The store may use cookies, pixels, local storage, tags and similar technologies for cart and checkout functionality, security, preferences, analytics and advertising. Strictly necessary technologies may operate without consent where the legal exemption applies. Non-essential analytics, advertising or profiling technologies are used only with the permission required by law. You can use the site's cookie controls and browser settings. Withdrawing consent does not affect processing already carried out lawfully.

9. Fraud checks and automated decisions

Payment, fraud and security providers may automatically assess transaction, device, identity and address signals. A provider may decline or hold a payment under its own terms. We may use risk scores to decide whether manual verification is needed, but we do not intend to make a solely automated decision with legal or similarly significant effect unless the law permits it and appropriate safeguards apply.

If you believe an order or account was wrongly restricted by an automated check, contact hello@koreanlashlift.eu. We may ask for information needed to verify the transaction and request human review where available.

10. Retention

We keep identifiable information only as long as necessary for the stated purpose and review it under our retention schedule. Typical periods are:

order, invoice, VAT, payment-status and delivery records: normally six years after the relevant financial period, or longer where a legal hold, tax rule or dispute requires it;
account information: while the account is active and normally up to two years after closure, except where linked transaction, course, suppression or claim records must be kept longer;
course enrolment, access, assessment and completion records: for the access period and then as needed for contract, certificate verification, intellectual-property enforcement and legal claims, normally up to six years;
support, return, safety and complaint records: normally six years after the matter closes where needed for claims, product safety and consistent customer service;
abandoned-cart information: ordinarily up to 90 days unless it becomes part of an order, security record or permitted marketing record;
marketing consent and campaign records: while marketing continues and afterwards as needed to prove consent or compliance; and
minimal suppression records: for as long as necessary to respect an opt-out and prevent renewed marketing;
security and technical logs: ordinarily up to 12 months, or longer where needed to investigate an incident, fraud or legal claim; and
cookie and similar identifiers: for the lifespan stated in the applicable cookie information, subject to your consent choices.

We may keep anonymised information that no longer identifies an individual. Backups may retain data for a limited rolling period before secure deletion.

11. Security

We use proportionate technical and organisational measures designed to protect information against unauthorised access, loss, alteration and disclosure. Measures include access controls, account authentication, encryption in transit where supported, provider due diligence, backups, logging and restricted administrative access. No internet service is completely secure. You must keep your credentials confidential and contact us promptly if you suspect misuse.

12. Your rights

Subject to the conditions and exemptions in applicable law, you may:

ask for access to your personal information;
ask us to correct inaccurate or incomplete information;
ask us to erase information;
ask us to restrict processing;
object to processing based on legitimate interests and object at any time to direct marketing;
ask for portable information where the portability right applies;
withdraw consent for future processing at any time; and
ask for safeguards in relation to qualifying automated decisions.

These rights are not absolute. For example, we may retain information needed for tax, safety, fraud prevention, legal claims or suppression of future marketing. We may verify identity and ask for information needed to locate the relevant records. We normally respond within one month, subject to any lawful extension.

13. Complaints

Contact hello@koreanlashlift.eu first so we can investigate. You also have the right to complain to the Information Commissioner's Office:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Telephone 0303 123 1113
Website https://ico.org.uk/make-a-complaint/

You may also complain to another supervisory authority that is competent for your circumstances, including the authority in your place of habitual residence where applicable.

14. Children

The store, professional products and courses are not directed to children. You must be at least 18 to order or create a course account. Contact us if you believe a child has provided personal information unlawfully.

15. Third party links

The website may link to a third-party site. That organisation controls its own processing, and its privacy notice applies. A link does not make us responsible for the third party's practices.

16. Changes to this policy

We may update this policy when the store, providers or law changes. The current version and effective date appear on this page. If a change materially affects an existing use of personal information, we will provide additional notice where the law requires it.

17. Contact

Send privacy questions or rights requests to hello@koreanlashlift.eu or write to BEAUTYBOOST LTD, Evagora Pallikaridi 38, 8010 Paphos, Cyprus.

Privacy Policy