Skip to main content
UK launch: become one of the first Fascia Instructors – London, November 2026.Book your place
Privacy Policy
Last updated: 21 October 2026
This policy explains how Fascia Innovation Sweden AB ("Fascia Academy", "we", "us") uses personal data when you visit fasciaacademy.com, book or take one of our courses, register for a webinar, apply for the UK Instructor Programme, sign in to the portal or contact us.
It follows the EU General Data Protection Regulation (GDPR) and the Swedish Data Protection Act. For people in the United Kingdom it also follows the UK GDPR and the Data Protection Act 2018, and for electronic marketing and cookies the Privacy and Electronic Communications Regulations (PECR). Cookies are explained in more detail in our Cookie Policy.
1. Who is responsible for your data
The controller is Fascia Innovation Sweden AB, organisation number 556583-8918, Tingsvägen 17, 191 61 Sollentuna, Sweden, which trades as Fascia Academy.
For anything about your personal data, write to info@fasciaacademy.com. Customers in the United Kingdom can also call +44 7426 799548.
The course leaders who run a course for us are described in section 4. When we say "you" we mean the person the data is about.
2. What personal data we collect and where it comes from
| Kind of data | Examples | Where it comes from |
|---|---|---|
| Enquiries | Name, email address, phone number, subject and message | You, in a contact form or an email |
| Bookings and orders | Name, email, phone, billing details, company name and organisation number for business customers, the course and date, order status and amount, payment references. Card details are handled by the payment provider and never reach us | You, and the payment provider |
| Registrations and participation | Bookings made in our booking calendars, participant lists, attendance, exam results and certificates (name, email, course, date, verification code) | You, and the course leader |
| Customer account | If you sign in with Google to see your orders: name, email address, Google account identifier, sign-in method and time of the last sign-in | You, through Google |
| Webinars, events and marketing | Registration details (name, email, phone), the campaign you came from (for example utm_source in the web address), whether you have agreed to marketing | You, and the web address you came from |
| Course leaders, instructors and affiliates | Name, email, phone, profile link, role, invoice reference, password (stored only in encrypted form), sign-in sessions, an activity log that includes IP addresses, monthly settlements and payments | You, and us |
| Technical data | IP address, browser and device, pages viewed, date and time, the page you came from, security logs | Your browser, automatically |
| Cookies and similar technologies | Online identifiers and how you use the site, only after you agree where the law requires it. See the Cookie Policy | Your browser |
| Your cookie choices | Your choice, the time, the version of the banner and a consent identifier, so that we can show that you agreed or declined | You, through our cookie banner and the Semantiko consent panel |
We do not ask for health information. Please do not include it in a message or a form. If you tell us about an injury or a condition so that we can adapt a practical session, we use it only for that purpose.
3. Why we use your data and on what legal basis
| Purpose | Legal basis |
|---|---|
| Provide the courses you book: take bookings and payments, give access to digital material, send confirmations, handle rebooking and refunds | Contract (GDPR Article 6(1)(b)) |
| Answer your questions and give support | Contract, or our legitimate interest in answering people who contact us (Article 6(1)(b) and (f)) |
| Run courses and certification: share participant lists with the course leader, record attendance and exam results, issue certificates and let others verify them | Contract, and our legitimate interest in keeping reliable records and preventing false certificates (Article 6(1)(b) and (f)) |
| Webinars and events: register you, send the link and reminders, and follow up on the event | Contract, or our legitimate interest in running the event you signed up for (Article 6(1)(b) and (f)) |
| Marketing by email or text message: newsletters, offers and invitations | Your consent (Article 6(1)(a)). For existing customers we may also write about similar courses where the law allows it, relying on our legitimate interest, and you can always say no. See section 10 |
| Measure how the site is used and how advertising performs (Google Analytics, Microsoft Clarity, Meta Pixel) | Your consent (Article 6(1)(a)), which is also what the ePrivacy rules and PECR require for these cookies |
| Keep the site secure, prevent misuse, find and fix errors | Our legitimate interest in a secure and working service (Article 6(1)(f)) |
| Bookkeeping, tax and other legal duties | Legal obligation (Article 6(1)(c)) |
| Establish, exercise or defend legal claims | Our legitimate interest (Article 6(1)(f)) |
| Run the portal for course leaders and instructors, and calculate and pay settlements | Contract and legal obligation (Article 6(1)(b) and (c)) |
| Keep a record of your cookie choices | Legal obligation to be able to show consent, and our legitimate interest (Article 6(1)(c) and (f)) |
Where we rely on legitimate interest we have weighed it against your interests and rights. You can ask us for a summary of that assessment.
We do not make decisions about you by solely automated means that have legal or similarly significant effects.
4. Who we share data with
We use the following companies to run the site and the courses. They act on our instructions as processors, except where the table says otherwise.
| Recipient | What they do for us | Where it is based |
|---|---|---|
| HighLevel (LeadConnector) | Customer register, forms, booking calendars, email and text messages, automations, and booking and payment for UK courses and events | United States |
| Stripe | Card and other payments on the website. Stripe also acts as an independent controller for fraud prevention and its own legal duties | Ireland and the United States |
| Sign in with Google, sending of order emails (Gmail), Google Tag Manager, Google Analytics, Google Maps, Google Fonts and YouTube | Ireland and the United States | |
| Meta | Meta Pixel: measuring and optimising advertising on Facebook and Instagram. Meta may act as a joint controller for the data its pixel collects, under Meta's business tools terms | Ireland and the United States |
| Microsoft (Clarity) | Behavioural analytics, including replays of visits | Ireland and the United States |
| Semantiko | The consent panel and the record of your cookie choices | See Semantiko's own information |
| Zoom | Live webinars | United States |
| Cloudflare | Content delivery, protection against attacks and bot protection in forms. The traffic to the site passes through Cloudflare | United States, with servers worldwide |
| Linode (Akamai) | Hosting of the website and its database | See the section on transfers |
| Course leaders | The independent instructors who run the course you booked get your name and contact details and the participant list for that course, and use them only for the course | Sweden and the United Kingdom |
| Advisers and authorities | Accountants, auditors and legal advisers, and authorities, courts and the police when the law requires it | Sweden |
If our business or part of it is sold or merged, the data may be passed on to the new owner, who must follow this policy. We never sell your personal data.
5. Transfers outside the EEA and the United Kingdom
Some of the companies above are based in, or store data in, countries outside the European Economic Area (EEA) and the United Kingdom, in particular the United States. We make sure the transfer is lawful, using one of these safeguards, depending on the provider:
- an adequacy decision, for example the EU–US Data Privacy Framework and the UK Extension to it, for providers that are certified under it
- the European Commission's Standard Contractual Clauses, together with the UK Addendum or the UK International Data Transfer Agreement for data from the United Kingdom, with additional measures where needed
You can ask us for a copy of the safeguards for a particular provider at info@fasciaacademy.com.
6. How long we keep your data
| Data | How long |
|---|---|
| Enquiries from the contact form | 12 months after we receive them |
| Orders, invoices, payment and other accounting records | Seven years from the end of the calendar year in which the financial year ended, as the Swedish Accounting Act requires |
| Customer accounts | Until you ask us to delete the account |
| Participation, attendance and exam records, and certificates | While the certificate is valid, so that it can be verified. You can ask us to remove your details; we then weigh your request against the need for a reliable record |
| Marketing contacts | Until you withdraw your consent or unsubscribe. We then keep only the minimum needed to respect your choice |
| Portal accounts for course leaders and instructors | While you work with us, and afterwards for as long as accounting law requires for payments |
| Sign-in sessions | 7 days (30 days for administrators), and 30 days for customer accounts |
| Security and server logs | A limited time, only as long as needed for security and to fix errors |
| Cookies and consent records | As stated in the Cookie Policy. The consent cookie lasts up to 13 months |
When a period ends we delete or anonymise the data, unless the law requires us to keep it longer or it is needed for a legal claim.
7. Your rights
Under the GDPR and the UK GDPR you have the right to:
- access your personal data and get a copy
- have inaccurate data corrected and incomplete data completed
- have your data erased in the cases the law sets out
- restrict how we use your data in certain cases
- receive the data you gave us in a common format and have it moved to someone else (portability), where we use it on the basis of contract or consent
- object to processing that rests on our legitimate interest, and to direct marketing at any time (this right is absolute for marketing)
- withdraw your consent at any time, as easily as you gave it. Withdrawal does not affect what we did before
To use a right, write to info@fasciaacademy.com. We answer within one month. If a request is complicated or we get many, we may extend that by up to two months and will tell you why. It costs nothing, and we may ask you to confirm who you are.
8. Complaints to a supervisory authority
You can always complain to the authority that supervises data protection:
- Sweden: Integritetsskyddsmyndigheten (IMY), www.imy.se (opens in a new tab)
- United Kingdom: the Information Commissioner's Office (ICO), ico.org.uk (opens in a new tab), telephone 0303 123 1113
- Elsewhere in the EU or the EEA: the data protection authority in the country where you live or work. The European Data Protection Board lists them at edpb.europa.eu (opens in a new tab)
We would be glad to hear from you first, so that we can try to put things right.
For cookies in Sweden the supervisory authority is the Swedish Post and Telecom Authority (PTS), pts.se (opens in a new tab).
10. Marketing messages
We send marketing emails and text messages only if you have agreed, or, to existing customers about similar courses, where the law allows it and you have been given a simple way to say no. Every message tells you how to unsubscribe, and you can also write to us. Messages that you need to take part in a course or a webinar, such as a confirmation, a link or a reminder, are not marketing.
11. How we protect your data
We protect personal data with technical and organisational measures that fit the risk: the website is served over an encrypted connection (HTTPS), passwords are stored only in encrypted form, sign-in cookies cannot be read by scripts on the page, access to the portal is limited to the people who need it and is logged, and our providers are bound by agreements. If a personal data breach puts your rights at risk we will tell you and the authority as the law requires.
12. Children
Our courses and webinars are for adults and for people training to work professionally. We do not knowingly collect personal data from anyone under 16. If you think a child has given us data, write to us and we will delete it.
13. Other websites
Our pages link to other services, for example Facebook, Instagram and YouTube, and show forms, booking pages and films from other companies. They have their own privacy policies, which apply when you use them.
14. Changes to this policy
We update this policy when what we do changes or the law changes. The date at the top shows the latest version. If a change is important for you, we will tell you on the website or by email.