Last updated: 28/04/2026
We run www.surgeahead.co.uk and related sites.
We collect and use personal data when you:
- visit our website
- buy training or eLearning
- contact us
- sign up to marketing updates
We are the data controller for UK data protection law purposes.
If you have questions, contact: lucy@surgeahead.co.uk
1. What we collect
We collect:
Information you give us
- name
- email address
- phone number
- company details
- billing details
- training or enquiry information
- purchase history
Information collected automatically
- IP address
- device and browser type
- pages you view and how you use the site
- cookies
- approximate location from IP address
We only collect what we need to run the business and deliver services.
2. How we use your information
We use your data to:
Deliver what you buy
- process orders and payments
- provide training and eLearning access
- manage customer accounts
- send service emails (like confirmations and access details)
Run and improve the business
- improve website performance and user experience
- understand what content and services are useful
- prevent fraud and misuse
Marketing (only where allowed)
We may send marketing if:
- you have opted in, or
- you are an existing customer and we offer similar services
You can unsubscribe at any time.
3. Legal basis for using your data
We rely on:
- Contract: to deliver what you buy
- Legal obligation: tax and accounting rules
- Legitimate interests: running and improving our business
- Consent: marketing and non-essential cookies
Where we rely on legitimate interests, we only use your data where it does not override your rights.
4. Ecommerce and payments
If you buy from us:
- your contract starts when payment is confirmed
- payments are handled securely by trusted third parties
- we do not store full card details
- we issue invoices where required (including VAT invoices)
- we keep transaction records for up to 6 years for tax and legal reasons
Refunds and cancellations follow our terms and UK consumer law.
5. Who we share data with
We share data only where needed to run our services:
- payment providers
- eLearning platform providers
- email and CRM systems
- website hosting providers
- professional advisers (accountants, legal advisors)
- regulators or law enforcement if required by law
All third parties must protect your data and only use it for agreed purposes.
We do not sell your personal data.
6. How long we keep your data
We only keep data for as long as needed:
- customer records: up to 6 years (tax and legal rules)
- marketing data: until you opt out or it becomes inactive
- enquiry data: up to 24 months
7. Your rights
You can:
- request a copy of your data
- ask us to correct incorrect information
- ask us to delete your data
- restrict how we use your data
- object to certain types of processing
- withdraw consent at any time
- ask us to transfer your data to another provider
Email us to exercise your rights.
We may need to keep some data where the law requires it.
8. Marketing choices
We only send marketing when we are allowed to.
Every email includes an unsubscribe link.
You can also email us anytime to stop marketing.
We do not use intrusive profiling or automated decision-making.
9. Security
We use appropriate technical and organisational measures to protect your data.
No online system is 100% secure, but we take reasonable steps to reduce risk.
10. International data transfers
Some service providers may process data outside the UK.
When this happens, we ensure your data is protected using UK-approved safeguards such as:
- adequacy decisions, or
- UK International Data Transfer Agreements
11. Third-party links
Our website may link to other websites.
We are not responsible for their content or privacy practices.
12. Changes to this policy
We may update this policy from time to time.
If changes are significant, we will highlight them on our website.
13. Complaints
If you are unhappy with how we use your data, contact us first.
You can also complain to:
Information Commissioner’s Office (ICO)
https://ico.org.uk/