Privacy Policy

1.1. UTN College (trading as Under the Needle College) is dedicated to protecting the privacy, confidentiality, and security of all personal data provided by prospective, enrolled, and graduating students.

1.2. For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, UTN College acts as the Data Controller in respect of your personal information.

2.1. We collect and process personal data when you enquire, register, make a payment, or participate in our training courses. This information includes:

• Identity & Contact Details: Full name, date of birth, residential address, telephone number, and email address.
• Enrolment Verification: Proof of identity and age (to ensure compliance with statutory licensing and insurance prerequisites).
• Financial & Payment Records: Billing address, booking deposit transactions, payment confirmation receipts, and transaction IDs (card numbers are securely processed by authorized third-party gateways and not retained by the College).
• Academic & Attendance Records: Daily register attendance logs (monitoring the 90% attendance requirement), milestone progression, assessment rubrics, and certification records.
• Communications: Records of written correspondence, emails, applications, appeals, or queries submitted to the College.

3.1. Practical tattoo tuition involves exposure to clinical instruments, sterile needles, inks, and bodily fluids. To satisfy statutory UK health and safety and infection-control regulations, we may collect relevant health information.

3.2. In accordance with Clauses 9.6 and 20.6 of our Enrolment Terms:

• Any disclosure regarding prescribed medication, mobility needs, or reasonable adjustments will be handled strictly confidentially.
• Information concerning blood-borne pathogen awareness or health contraindications is processed solely to ensure safe working practices for you, fellow students, and live models.
• Disability-related accommodation requests are reviewed on an individual basis to implement appropriate adjustments without compromising clinical safety standards.

4.1. Photography and video recordings may take place during studio sessions for legitimate educational purposes, such as portfolio reviews, technique feedback, and milestone assessments.

4.3. You are free to grant or withhold promotional marketing consent without any detriment to your tuition, assessment, or certification.

4.4. Students must strictly respect the confidentiality and privacy of live models, instructors, and fellow students, and may not capture or publish media of models without express prior authorisation.

5.1. Under Article 6 of the UK GDPR, we process your personal data under the following legal bases:

• Contractual Performance: Processing necessary to fulfill our contract with you (managing bookings, administering courses, delivering instruction, providing feedback, and issuing certificates).
• Legal & Regulatory Obligations: Processing required to comply with UK health and safety legislation, local authority special treatments licensing regulations, and HMRC financial reporting.
• Legitimate Interests: Managing college administration, ensuring studio security, preventing misconduct, and improving our curriculum.
• Explicit Consent: Where you provide optional consent for promotional media usage or electronic marketing communications.

6.1. We use collected personal information solely for transparent and lawful purposes, including:

• Processing course applications, verifying entry qualifications, and managing seat availability.
• Invoicing, processing deposits and balance payments, and managing refund requests.
• Delivering the three-month curriculum, practical demonstrations, and supervised clinic hours.
• Tracking daily attendance to verify compliance with the 90% compulsory attendance requirement.
• Evaluating technical competency, hygiene compliance, and practical assessments for certification.
• Responding to your inquiries, support requests, appeals, or complaints.

7.1. Zero Data Selling: UTN College does not sell, rent, or lease student personal data to third parties under any circumstances.

7.2. We share personal data only with trusted service partners operating under strict data processing agreements:

• Payment Providers: Certified payment gateways and financing platforms (such as PayPal) to process transactions securely.
• IT & Cloud Infrastructure: Secure web hosting, email servers, and encrypted database platforms utilized for educational record-keeping.
• Statutory & Regulatory Bodies: Relevant public health or local authority licensing authorities where required by UK statute.
• Emergency Services: Paramedical or emergency responders in the event of an urgent medical emergency on studio premises.

8.1. We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, or to satisfy legal, accounting, and reporting requirements:

• Student Enrolment & Assessment Records: Retained for a period of up to 6 years following completion to enable verification of graduation, replacement certificates, and course references.
• Financial & Payment Records: Retained for 6 years in accordance with UK statutory accounting and HMRC requirements.
• General Enquiries: Inquiries that do not lead to enrolment are securely purged after 12 months.
• Marketing Data: Retained until consent is withdrawn or you opt out of future communications.

9.1. We implement robust technical and organizational security measures to protect your personal data against accidental loss, unauthorized access, alteration, or disclosure.

9.2. Security measures include SSL/TLS encryption for all website data transfers, role-based access restrictions ensuring only authorised instructors and administrative staff access student portfolios, and secure digital storage.

10.1. As an individual whose data is processed by the College, you hold statutory rights under UK data protection legislation:

• Right of Access: You may request a copy of the personal information we hold about you (Subject Access Request).
• Right to Rectification: You may request that incorrect or incomplete records be updated without delay.
• Right to Erasure: You may request the deletion of your personal data where retention is no longer legally necessary.
• Right to Restrict Processing: You may request that we suspend processing your data in certain scenarios.
• Right to Data Portability: You may request your personal data in a structured, machine-readable format.
• Right to Object: You may object to data processing carried out under our legitimate interests.
• Right to Withdraw Consent: Where processing relies on consent (e.g., marketing), you may withdraw it at any time.

10.2. To exercise any of these statutory rights, please email our Data Protection team at Info@utncollege.co.uk. We respond to all verified requests within one calendar month.

11.1. We comply fully with the Privacy and Electronic Communications Regulations (PECR). We only send promotional announcements, upcoming intake dates, or guest artist masterclasses where you have provided active, opt-in consent.

11.2. You can withdraw consent or opt out at any time by clicking the unsubscribe link at the footer of any marketing email, or by emailing us directly at Info@utncollege.co.uk.

12.1. If you have questions or concerns regarding our privacy practices, please contact us first so we can promptly address them:

Email: Info@utncollege.co.uk
Post: Data Protection Officer, UTN College, Unit 25a, The Tay Building, 2A Wrentham Ave, London NW10 3HA

12.2. You also retain the right to lodge a formal complaint at any time with the UK supervisory authority for data protection: