Privacy Policy

Last updated: 29 September 2026

This privacy policy explains how Karla Osborne Hair and KOH Education Ltd collect, use, store and protect your personal information when you visit our websites, contact us, book a hair appointment, purchase our services, join our mailing list or enrol on one of our courses.

Who we are

This policy covers two separate businesses run by Karla Osborne:

Karla Osborne Hair

Karla Osborne Hair provides one-to-one hair colour and grey blending services and is operated by Karla Osborne as a sole trader.

Business address: 147 Spring Lane, Hemel Hempstead, England, HP1 3QZ
ICO registration number: [insert number, if applicable]

KOH Education Ltd

KOH Education Ltd provides The True Grey training courses for hairdressers.

Company number: 16894163
Registered in: England and Wales
Registered office: 147 Spring Lane, Hemel Hempstead, England, HP1 3QZ
ICO registration number: [insert number, if applicable]

Karla Osborne Hair and KOH Education Ltd are separate businesses and are each responsible for the personal information they collect and use.

For example, Karla Osborne Hair is the data controller for information relating to salon clients and appointments. KOH Education Ltd is the data controller for course enquiries, students and the KOH Education mailing list.

If you have any questions about this policy or how we use your information, please contact us at [email address] or write to us at:

147 Spring Lane
Hemel Hempstead
England
HP1 3QZ

The information we collect

Depending on how you interact with us, we may collect:

  • your name

  • email address

  • telephone number

  • information you provide when making an enquiry or booking an appointment

  • the content of messages you send us by email, website form, Instagram or other communication channels

  • appointment and booking information

  • information about your hair, colour history and previous treatments where this is relevant to providing our services

  • information about allergies, sensitivities, previous reactions or other health information where you provide it and it is relevant to your treatment

  • photographs of your hair taken before or after an appointment, where you have agreed to this

  • course enrolment and participation information

  • information about your purchases and payments

  • information you provide when completing course-related forms or communicating with us as a student

  • information about how you use our websites, including pages visited, approximate location, device and browser information, where this is collected through cookies or similar technologies.

We do not store your full payment card details. Payments are processed by our payment providers.

Health information

Some information you provide to us may relate to your health, such as allergies, sensitivities, skin or scalp conditions or previous reactions to hair products.

Health information is treated as special category personal data under UK data protection law. We only collect and use this information where it is relevant to providing our services, keeping you safe or meeting our legal obligations, and we take appropriate care to protect it.

Where we need your explicit consent to process health information, we will ask for this separately.

How we use your information and our lawful basis

UK data protection law requires us to have a lawful basis for using personal information. The basis we rely on depends on what we are doing with your information.

To respond to enquiries and arrange appointments

We use your contact details and relevant information to respond to enquiries, provide quotations where appropriate, arrange and manage appointments and communicate with you about your booking.

Our lawful basis is taking steps at your request before entering into a contract, and performing our contract with you once you book a service.

To provide hair services safely

We may use information about your hair, previous treatments, allergies, sensitivities, reactions and other relevant information you provide to us so that we can provide our services safely and appropriately.

Where this information includes health information, we will only process it where we have an appropriate legal condition for doing so under UK data protection law.

To provide our courses

KOH Education Ltd uses your information to process your enrolment and payment, create and manage your student account, provide access to your course, send course invitation and access links, deliver course materials, communicate with you about your course and provide learner support. These communications are part of providing the course and are not marketing messages.

Our lawful basis is performing our contract with you.

To send marketing emails

If you subscribe to our mailing list, we may send you information about hair, grey blending, The True Grey, courses, events, services, news and offers.

Our lawful basis for marketing to people who have actively subscribed is consent.

You can withdraw your consent at any time by using the unsubscribe link in our emails or by contacting us.

We may also send marketing about similar products or services to existing customers where the conditions of the soft opt-in under the Privacy and Electronic Communications Regulations are met. Where we do this, you will always have a simple opportunity to opt out, both when your details are collected and in every subsequent marketing message.

If you enrol on a course, we may contact you by email about your enrolment, course access, course materials, course dates and other information necessary to provide and administer the course. These emails are sent as part of our contract with you and are not affected by your marketing preferences.

To use before and after photographs

We may take photographs of your hair before or after an appointment to record your treatment or to help us demonstrate our work.

Where photographs are used for marketing, including on our websites, social media, course materials or other promotional channels, we will ask for your permission.

You do not have to agree to your photographs being used for marketing and this will not affect the service you receive.

Where we rely on consent, you can withdraw your consent at any time.

If a photograph has already been published online, we will remove it from channels that we control when reasonably possible. We cannot always control copies that have been downloaded, shared or reposted by other people.

To run and administer our businesses

We use personal information to manage our businesses, maintain records, communicate with customers and students, manage payments, accounts and administration, and comply with our legal and regulatory obligations.

Depending on the activity, our lawful basis may be legitimate interests, performing a contract or legal obligation.

To meet our legal and financial obligations

We keep appropriate financial, accounting and business records where we are legally required to do so.

Our lawful basis is legal obligation.

To understand and improve our websites

Where we use non-essential analytics cookies or similar technologies, we use information about website visits to understand how people use our websites and improve them.

Our lawful basis for setting non-essential analytics cookies is consent.

You can choose whether to accept non-essential cookies when you visit our websites and can change your preferences later.

Who we share your information with

We do not sell your personal information.

We may share personal information with trusted suppliers and service providers who help us operate our businesses. We only provide them with the information they need for the services they provide.

These may include:

  • Squarespace, for website hosting and website forms

  • Systeme.io, course hosting and administration, managing learner accounts, sending course materials and course invitation and access links, managing course-related communications and sending marketing emails. Systeme.io is also integrated with our payment provider, Stripe, to support course purchases and enrolments.

  • Stripe, secure payment processing for course purchases and other payments made through our Systeme.io checkout. Stripe processes your payment details directly. We do not receive or store your full card details.

  • Sage, for accounting and financial administration

  • Google, secure payment processing for course purchases and other payments made through our Systeme.io checkout. Stripe processes your payment details directly. We do not receive or store your full card details.

  • Meta, including Instagram and Facebook, where you contact us or interact with us through its services. if you contact us or interact with us through Instagram or facebook, Meta will process information in accordance with its own privacy policy.

  • WhatsApp / Meta, we may use WhatsApp to communicate with clients, learners and prospective clients or learners, including for appointment-related communications, course-related communications and customer support. WhatsApp and Meta process information in accordance with their own privacy policies.

  • professional advisers and contractors people who help us with administration, course delivery or the running of our businesses. They are expected to keep personal information confidential and only use it for the purposes for which we provide it.

We may also disclose personal information where we are required to do so by law, court order or a regulatory authority.

Where third-party providers process information on our behalf, we take appropriate steps to ensure that they provide appropriate safeguards for personal information.

International transfers

Some of our service providers may process or store personal information outside the UK.

Where personal information is transferred outside the UK, we ensure that the transfer is made in accordance with UK data protection law. This may include relying on UK adequacy regulations, appropriate contractual safeguards or another lawful transfer mechanism, depending on the country and service provider involved.

For transfers to the United States, we will only rely on the UK Extension to the EU-US Data Privacy Framework where the relevant organisation has the appropriate active certification. Where another transfer mechanism is required, we will put appropriate safeguards in place.

Cookies

Our websites use cookies and similar technologies.

Some cookies are strictly necessary for the websites to function, for example to provide security or remember your cookie preferences.

We may also use non-essential cookies, such as analytics cookies, to understand how visitors use our websites and improve them.

We will ask for your consent before setting non-essential cookies or using similar technologies that require consent.

You can change or withdraw your cookie preferences at any time using the cookie settings available on our websites.

Our cookie information will explain the cookies and similar technologies we use, their purpose, the organisations that set them and, where relevant, how long they remain on your device.

How long we keep your information

We only keep personal information for as long as we reasonably need it for the purpose for which it was collected, including to meet legal, accounting or reporting requirements.

Our retention periods may include:

  • Client and student records: normally retained for as long as reasonably necessary to manage the client or student relationship and deal with any legal, financial or service-related issues. We will review these records periodically and delete or anonymise information that we no longer need.

  • Financial and accounting records: normally retained for at least six years where required by tax and accounting legislation.

  • Enquiries that do not lead to a booking or enrolment: normally retained for up to 12 months, unless there is a good reason to retain them for longer.

  • Mailing list information: retained while you remain subscribed, and removed or suppressed when you unsubscribe, subject to any information we need to retain to ensure we do not contact you again.

  • Marketing photographs: retained until you withdraw your consent or we no longer have a legitimate reason to retain them.

Different retention periods may apply where we are legally required to keep information for longer or where we need it in connection with a legal claim.

We securely delete or anonymise information when it is no longer required.

Keeping your information safe

We take reasonable and appropriate technical and organisational measures to protect your personal information against loss, misuse, unauthorised access, alteration or disclosure.

These measures include using password-protected systems, limiting access to people who need the information and requiring anyone who works with us to respect the confidentiality of personal information.

No online system can be guaranteed to be completely secure, but we take reasonable steps to protect the information we hold.

Your rights

Depending on the circumstances, UK data protection law gives you rights in relation to your personal information. These may include the right to:

  • ask for a copy of the personal information we hold about you

  • ask us to correct inaccurate or incomplete information

  • ask us to delete your information where the legal conditions for deletion apply

  • ask us to restrict how we use your information in certain circumstances

  • object to certain uses of your information

  • object at any time to the use of your information for direct marketing

  • ask for your information to be provided to you or transferred to another organisation where the right to data portability applies

  • withdraw consent where we are relying on consent to process your information.

These rights are not all absolute and some exceptions may apply.

To exercise your rights, contact us at [email address].

We will normally respond within one month. In certain circumstances, we may be entitled to extend this period.

There is normally no charge for making a request.

Making a complaint

If you have a concern about how we have handled your personal information, please contact us first at hello@kohair.co.uk. We will do our best to resolve the issue.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent data protection regulator.

ICO website: ico.org.uk
Telephone: 0303 123 1113

Children

Our courses and services are intended for people aged 18 or over.

We do not knowingly collect personal information from children under 18 for these services.

If you believe that a child has provided us with personal information, please contact us so that we can review the information and take appropriate action.

Changes to this policy

We may update this privacy policy from time to time to reflect changes to our businesses, the services we use or data protection requirements.

The latest version will always be published on this page and will show the date it was last updated.