Privacy
Privacy notice
This notice explains what personal data we collect, why we collect it, who we share it with and the choices you have. We have tried to write it plainly.
Last updated 9 October 2026
1. Who we are
Trichollective is a membership community for cosmetic, clinical and medical hair and scalp professionals in Ireland and the United Kingdom. In this notice, “we”, “us” and “our” mean Trichollective.
Trichollective Ltd (company number 17506914, 66 Paul Street, London, EC2A 4NA, United Kingdom) is the data controller for the personal data described here. You can contact us about anything in this notice, including your rights, at karley@trichollective.net.
2. What we collect
We only collect what we need to run the service. Depending on how you use it, this may include:
- Account details: your name, email address, local chapter and, if you sign in with Google, the basic profile details Google shares with us.
- Directory listings and profiles: the professional details you choose to publish, such as your name, discipline, city, services, website, phone number, photograph and a short biography.
- Verification documents: certificates, diplomas or membership documents you send so we can check your qualifications. These are private and only seen by the team members who review them.
- Payments: your plan, billing address, billing history and the status of your subscription or tickets. Card details are handled by Stripe and never reach our servers.
- Business details: for business plans and partner pages, the business name, category, website, logo, contact details and the results of offers you run.
- Community activity: posts, comments, messages, client referrals, event bookings, course progress and any certificates you earn.
- Assistant questions: the questions you ask the Assistant, which are used only to answer them.
- Event guests: the name and email address of people who buy a ticket without an account.
- Newsletter sign-ups and invitations: your email address, where you signed up, the campaign that brought you to the site and, if a colleague invited you, whose code you used.
- Enquiries: messages sent to professionals through the directory, and any email you send us.
- Technical data: information needed to keep the site secure and working, such as your IP address, browser type and the pages you request.
Please don't share health information about yourself or your clients in the community, in referrals, in the Assistant or in directory enquiries. Case discussions must always be anonymised (see our community standards). We don't intend to collect special category data, and we delete it if we find it.
3. How we use it, and our lawful basis
Under the GDPR and the UK GDPR, we must have a lawful basis for each use of your data.
- To provide your account and membership, publish your listing or partner page, run courses and events, issue certificates and take payment. Basis: performance of our contract with you.
- To verify qualifications and show a verified badge. Basis: our legitimate interest, shared with the public, in a directory people can trust.
- To send the newsletter and news of events and courses. Basis: your consent, which you can withdraw at any time using the link in every email. Where you are already a member, we may send news of similar services under our legitimate interests, and you can opt out at any time.
- To send service messages, such as sign-in links, receipts, renewal reminders and notice that a free listing is about to lapse. Basis: performance of our contract, and our legitimate interest in running the service well.
- To understand what brings people to the site, such as which event or campaign led to a sign-up, and to give referral rewards. Basis: our legitimate interests.
- To keep the community safe, review listings and posts before or after they go live, prevent fraud and enforce our terms. Basis: our legitimate interests.
- To meet our legal obligations, such as keeping tax and financial records. Basis: legal obligation.
Where we rely on legitimate interests, we have weighed them against your rights, and you can object at any time.
4. The public directory
The directory is public by design. Whatever you choose to include in your listing can be seen by anyone, and may be indexed by search engines. Every listing is reviewed by a person before it goes live.
Free founding listings are shown for 90 days. If you don't become a member in that time, your listing stops being shown publicly. We keep the details for a further 12 months so you can reactivate easily, unless you ask us to delete them sooner.
5. How we use AI tools
We use AI tools to help draft editorial content such as Trichozette, guides and course material, to transcribe podcast episodes, and to help moderate community posts. A person reviews and approves editorial content before it is published.
When you use the Assistant, your questions are sent to our AI provider to generate an answer. Our providers don't use this data to train their models.
We do not use AI to make decisions about you that have legal or similarly significant effects, and we never sell your data.
7. International transfers
Some of our providers process data outside Ireland, the European Economic Area or the United Kingdom, mainly in the United States. When that happens, we rely on an adequacy decision, such as the EU-US Data Privacy Framework and the UK extension to it, or on standard contractual clauses, with additional safeguards where needed. You can ask us for a copy of the safeguards that apply.
8. How long we keep it
- Account and membership data: for as long as you have an account, then up to two years.
- Payment and invoice records: for as long as tax law requires, normally six years.
- Verification documents: until they have been reviewed and for as long as your badge is shown, unless you withdraw them sooner.
- Newsletter data: until you unsubscribe.
- Assistant conversations: we don't save them. They are sent to our AI provider to produce an answer and are gone when you leave the page.
- Certificates: we keep a record of each certificate so it can still be verified, unless you ask us to withdraw it.
- Technical logs: for a short period, normally no more than 90 days.
9. Your rights
Under the GDPR and the UK GDPR, you have the right to:
- ask for a copy of the personal data we hold about you;
- ask us to correct anything that is wrong or incomplete;
- ask us to delete your data;
- ask us to restrict how we use it;
- object to how we use it where we rely on legitimate interests, and to direct marketing at any time;
- receive the data you gave us in a portable format;
- withdraw your consent at any time, where we rely on it.
To use any of these rights, email karley@trichollective.net. There is no charge, and we'll reply within one month. We may need to confirm your identity first.
If you are unhappy with how we have handled your data, you can complain to the Data Protection Commission in Ireland or, in the UK, to the Information Commissioner's Office. We'd be grateful for the chance to put things right first.
10. Children
Trichollective is for adults working in the hair and scalp professions. We don't knowingly collect data from anyone under 18, and we will delete it if we find we have.
12. Keeping your data safe
We use encryption in transit, restrict access to the people who need it, keep verification documents private, and review our providers' security. No system is perfectly secure, so if something does go wrong we will tell you and the relevant authority as the law requires.
13. Changes to this notice
We'll update this notice when our practices change, and we'll tell members by email about any significant change before it takes effect.