Privacy Policy

Bodhial Limited — Bodhial.com

ICO Registration: ZC230577 | Trademark: UK00004365450

Effective Date: 15 September 2026 | Last Updated: September 2026

Bodhial® is a registered trademark of Bodhial Limited (UK00004365450). Bodhial is a business-to-business membership platform for beauty and wellness professionals, brands, and industry partners. It does not promote, list, or sell beauty treatments, and does not operate as a consumer-facing directory. No special category data is collected or processed through this platform.

1. Who We Are

Bodhial.com is operated by Bodhial Limited (“Bodhial”, “we”, “us”, or “our”), a company incorporated in England and Wales. We are the data controller for all personal data processed through this website and our membership platform.

We are registered with the Information Commissioner’s Office (ICO):

ICO Registration Number: ZC230577
Registered: 25 August 2026 | Expires: 24 August 2027
Registered address: C/O Taxevo, 1 Cedar Office Park, Cobham Road, Ferndown Industrial Estate, Wimborne, BH21 7SB

Contact:

Email: data@bodhial.com
Phone: +44 7850 103003
Website: https://bodhial.com

2. What Data We Collect

Bodhial is a B2B networking and membership platform. The data we collect relates to professionals and businesses, not to consumers or end-clients. We do not collect or process special category data.

a) Member Account Data

Full name and professional or trading name
Business email address and phone number
Business address and billing address
Professional biography, specialisms, and any other profile content you choose to provide
Membership tier, subscription history, and payment records
Login credentials (passwords are stored in encrypted form and never visible to Bodhial staff)

b) Payment Data

Payment transactions are processed securely by Stripe. Bodhial does not store card numbers or full payment details.
Billing name, address, and transaction history are retained for financial record-keeping purposes.
Where Circle’s built-in payment infrastructure is used, Circle’s own data processing terms apply to that element of the transaction.

c) Usage and Technical Data

IP address and device identifiers
Pages visited, features used, and time spent on the platform
Browser type, operating system, and referral source
Course completion records and event attendance

d) Communications Data

Enquiries and support messages sent to Bodhial
Email marketing preferences and engagement data (open rates, click-throughs)
Survey responses and feedback

3. How We Collect Your Data

We collect data when you:

Create a Bodhial membership account
Subscribe to a monthly or annual membership plan
Complete or update your professional profile
Purchase access to courses, events, or additional member content
Contact us via email, phone, or the website contact form
Subscribe to our newsletter or marketing communications
Interact with Bodhial on social media
Attend Bodhial events, whether in-person or online

4. Legal Bases for Processing

Under the UK General Data Protection Regulation (UK GDPR), we rely on the following lawful bases:

Contract – to provide your membership, process payments, grant platform access, and deliver the services you have subscribed to.
Consent – for email marketing and newsletters. You may withdraw consent at any time by unsubscribing.
Legitimate Interests – for platform analytics and improvement, fraud prevention, and professional B2B outreach to existing and prospective members. We have assessed these interests against your rights and are satisfied they are not overridden.
Legal Obligation – where processing is required by law, including financial record-keeping under HMRC requirements.

5. How We Use Your Data

Create and manage your membership account and profile
Process subscription payments and issue receipts
Provide access to the Bodhial platform, courses, events, and member community
Send service communications, account notifications, and renewal reminders
Send marketing communications (with your consent, or on a soft opt-in basis under PECR where applicable to existing members)
Analyse platform usage to improve our services and member experience
Prevent fraud and maintain platform security
Comply with our legal and regulatory obligations

6. Automated Decision-Making

We do not make decisions about you using solely automated processing that produce legal or similarly significant effects, as described under Article 22 of the UK GDPR. Any personalisation of platform content involves human oversight and does not produce legal or significant effects on members.

7. Who We Share Your Data With

Service Providers (Data Processors)

We work with the following third-party processors, each bound by a data processing agreement and required to comply with UK GDPR:

Stripe — payment processing and subscription management
Circle — membership platform and community infrastructure
Brevo (formerly Sendinblue) — email marketing and transactional email
Google Workspace — internal communications and document management
Squarespace — website hosting and infrastructure
Google Analytics — aggregated, anonymised website usage data

Member Visibility

Your professional profile, where published on the platform, will be visible to other Bodhial members. You control what information you include and can update or remove it at any time through your account settings. Bodhial does not share member profile data with consumers or the general public.

Legal Disclosures

We may disclose data to law enforcement, regulatory bodies, or courts where required by law or to protect the legitimate rights and safety of Bodhial or others.

8. International Data Transfers

Some of our service providers, including Stripe, Circle, and Google, operate infrastructure outside the UK. Where personal data is transferred internationally, we ensure appropriate safeguards are in place, including UK International Data Transfer Agreements (IDTAs), Standard Contractual Clauses, or transfers to countries with a UK Government adequacy decision.

9. Data Retention

Member account data: retained for the duration of your membership plus 6 years following closure, in line with HMRC financial record-keeping requirements
Payment and transaction records: 6 years from the date of the transaction
Marketing and communications data: until you withdraw consent or unsubscribe
Event and course completion records: 3 years from the date of attendance or completion

When data is no longer required, it is securely deleted or anonymised.

10. Data Breaches

In the event of a personal data breach, we will assess the risk to individuals and notify the ICO within 72 hours where required by law. Where a breach is likely to result in a high risk to your rights and freedoms, we will notify you directly without undue delay, in accordance with our obligations under UK GDPR Article 34.

11. Your Rights Under UK GDPR

You have the following rights in relation to your personal data:

Right of access — to request a copy of the personal data we hold about you
Right to rectification — to correct inaccurate or incomplete data
Right to erasure — to request deletion of your data in certain circumstances
Right to restrict processing — to ask us to limit how we use your data
Right to data portability — to receive your data in a structured, machine-readable format
Right to object — to processing based on legitimate interests, or to direct marketing at any time
Right to withdraw consent — at any time where processing is based on consent, without affecting the lawfulness of prior processing
Right to lodge a complaint — with the ICO at ico.org.uk or by calling 0303 123 1113

To exercise any of your rights, please contact us at: data@bodhial.com. We will respond within one month.

12. Cookies and PECR

Our use of cookies is governed by the UK Privacy and Electronic Communications Regulations (PECR) alongside UK GDPR. Essential cookies required for the platform to function are placed on the basis of legitimate interests. Non-essential cookies (including analytics) are only placed with your consent, obtained through our cookie consent banner when you first visit the site.

For full details of the cookies we use and how to manage them, please see our Cookie Policy.

13. Security

We take the security of your data seriously and implement the following measures:

HTTPS encryption across all platform pages and member communications
Payment data handled exclusively by PCI-DSS compliant processors (Stripe)
Role-based access controls limiting staff access to personal data on a need-to-know basis
Regular security reviews and encrypted data backups

14. Children’s Privacy

Bodhial is a professional B2B platform intended solely for adults working in the beauty, wellness, and related industries. It is not directed at or accessible to children. In line with the UK Age Appropriate Design Code, we treat anyone under the age of 18 as a child for data protection purposes and do not knowingly collect their data. If you believe a minor has registered on the platform, please contact us immediately at data@bodhial.com.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Material changes will be communicated to registered members by email and by a prominent notice on the platform, with a minimum of 14 days’ notice before the change takes effect. The Last Updated date at the top of this document reflects the most recent version.

16. Contact Us

Email: data@bodhial.com
Phone: +44 7850 103003
Website: https://bodhial.com