Privacy Policy
TO BE COMPLETED: this page has never been dated — set `lastUpdated` in src/lib/legal.js
This notice explains what personal data we collect when you use this website and the learning portal, why we collect it, who we share it with, how long we keep it, and what you can ask us to do about it.
1. Who is responsible for your data
The data controller is TO BE COMPLETED: registered company name, registered at TO BE COMPLETED: registered address (TO BE COMPLETED: company registration number).
For anything in this notice, including a request to exercise your rights, write to TO BE COMPLETED: privacy contact address.
2. What we collect, and why
We collect only what the service needs to work. The table below is the complete list — it was written from the database schema rather than from a template, so if something is not named here, we do not store it.
| What | Why we have it | Lawful basis |
|---|---|---|
| Name and email address | To create and identify your account, to sign you in, and to contact you about your courses, events and payments. | Performance of a contract (Art. 6(1)(b)) |
| Password | Stored only as an Argon2 hash. We cannot read it, and nobody at our end can tell you what it is. | Performance of a contract |
| Phone number, country, profile picture, short bio | Optional profile details you choose to add. Your name and picture are visible to other participants on courses and events you take part in. | Performance of a contract |
| Professional details — job title, company, LinkedIn, expertise, years of experience | Optional. Used on instructor and speaker profiles, and to assess an application to teach. | Performance of a contract |
| Education details — college, branch, year of study, year of graduation | Optional. Used where a college sponsors your seat, and on applications. | Performance of a contract |
| IP address, browser user agent and device name | Recorded each time you sign in, so you can see and end sessions on devices you no longer use, and so we can investigate abuse or a compromised account. | Legitimate interests — account security (Art. 6(1)(f)) |
| Learning activity — enrolments, lesson progress, quiz attempts, assignment submissions, certificates issued | To deliver the course, resume where you left off, mark your work, and issue a certificate that can be verified. | Performance of a contract |
| Event activity — registrations, attendance, questions asked, reviews | To admit you to events, record attendance, and run the Q&A. | Performance of a contract |
| Organisation membership | Where a college or employer pays for your access, we record that you belong to it and which seat you occupy. See section 4. | Performance of a contract |
| Payment records — amount, currency, status, and a payment reference | To take payment, issue refunds, and meet accounting obligations. We never see or store your card details — see section 5. | Contract, and legal obligation for the accounting record (Art. 6(1)(c)) |
| Enquiries you send us — name, email, phone, your message, and which page you sent it from | To answer you, and to spot abuse of the form. | Legitimate interests — responding to an enquiry |
| Two-factor authentication settings | Only if you turn it on, to protect your account. | Performance of a contract |
We do not profile you for advertising, sell or rent your data, make decisions about you by automated means that produce legal effects, or collect special-category data (health, beliefs, biometrics, and so on). We do not ask for your card number.
4. If your college or employer pays for your access
Colleges and companies can buy access on behalf of their people. If you joined through one — because you signed in with an address on their email domain, or accepted their invitation — there are two things you should know.
- An administrator at that organisation can see your progress on the courses they paid for, next to your name. That means which courses you are on and how far through them you are. They cannot see your password, your payment details, your activity on courses they did not pay for, or anything you do outside their organisation.
- They can remove you from the organisation, which releases the seat and ends the access they were paying for. Your account, and anything you obtained outside their organisation, stays yours.
In this arrangement the organisation is a separate controller for its own purposes. If you want to know why they hold your data, ask them; if you want to know what we hold, ask us.
6. Where your data goes
Our database and file storage are hosted in TO BE COMPLETED: hosting region — e.g. AWS ap-south-1 (Mumbai). Some of the providers in section 5 process data outside the European Economic Area. Where they do, transfers rely on the European Commission’s Standard Contractual Clauses or an adequacy decision, and you may ask us for a copy of the safeguards in place.
7. How long we keep it
| Record | Kept for |
|---|---|
| Your account and profile | TO BE COMPLETED: account retention period |
| Learning records and certificates | TO BE COMPLETED: learning-record retention period |
| Payment and invoice records | TO BE COMPLETED: payment retention period, set by your tax obligations |
| Enquiries sent through the contact form | TO BE COMPLETED: enquiry retention period |
| Sign-in and device records | TO BE COMPLETED: security-record retention period |
Certificates are the one thing we deliberately keep after an account closes: a certificate that stops verifying is worthless to the person who earned it, and to anybody checking it.
8. Your rights
Under the GDPR you may ask us to do any of the following, free of charge, and we will answer within one month.
- See what we hold about you, and get a copy (Art. 15).
- Correct anything wrong (Art. 16). Most of it you can edit yourself in your profile.
- Have it deleted (Art. 17), where we have no overriding reason to keep it — a paid invoice, for instance, we are obliged to retain.
- Restrict what we do with it while a dispute is resolved (Art. 18).
- Take it with you in a portable, machine-readable form (Art. 20).
- Object to processing we base on legitimate interests (Art. 21).
- Withdraw consent at any time, where we relied on it — without affecting what we did before you withdrew it.
To exercise any of these, write to TO BE COMPLETED: privacy contact address. We may ask you to confirm who you are before we act, so that nobody else can make a request in your name.
If you are not satisfied with how we handle it, you can complain to a supervisory authority (Art. 77) — TO BE COMPLETED: the relevant supervisory authority and its website.
9. How we protect it
Passwords are hashed with Argon2 and are never stored or transmitted in a readable form. Access to the service uses short-lived tokens in cookies that JavaScript cannot read. Two-factor authentication is available on your account. Uploaded files are served through short-lived signed links rather than public URLs.
No system is perfect. If we ever suffer a breach that is likely to put your rights at risk, we will tell the supervisory authority within 72 hours and tell you without undue delay.
10. Children
This service is intended for people aged 16 and over. We do not knowingly collect data from children below that age. If you believe a child has given us their data, write to us and we will delete it.
11. Changes to this notice
If we change how we use your data, we will update this page and change the date at the top. Where a change is significant, we will tell you directly rather than relying on you to check.
See also Privacy Policy, Cookie Policy and Terms of Service.