UK Compliance Academy

UK Compliance Academy Limited (“we”, “us”) is committed to protecting your personal data and processing it lawfully, fairly and transparently under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

UK Compliance Academy Limited is registered in England and Wales, company number 17309952, registered office 128 City Road, London, EC1V 2NX, United Kingdom. We are registered with the Information Commissioner’s Office under registration number ZC232802. Contact us about anything in this policy at info@ukcomplianceacademy.co.uk.

We are the data controller where we decide why and how your personal data is used — for this website, for your membership and account, for keeping the platform secure, for payments, and for issuing and verifying certificates.

Most learners buy their own membership and hold it in their own name, and then our contract is with you directly. Where an organisation arranges and pays for training instead, the arrangement is with them — we explain below what that changes.

Where an employer invites you to join their organisation on our platform, assigns you courses and looks at your progress, that employer decides why it is doing so and is a data controller in its own right for that use. We are not acting on their instructions for your learning, so we are each responsible for our own part. If you want to know why your employer is monitoring your training, or how long they keep it, ask them.

What we collect and why

If you contact us

Your name, email address and message, so that we can reply. Lawful basis: our legitimate interests in answering you.

We do not send marketing emails to learners. If you ask us to let you know when something launches, we will keep your address for that and nothing else. If we ever start sending marketing, we will ask for your consent first, every message will carry an unsubscribe link, and you can tell us to stop at any time. The one time we contact anyone about our training because of you is when you ask us to contact the organisation you work for — see “When you finish a course” below.

After you complete a course, we email you once to ask how it went, with a link to leave a public review on Trustpilot. We do not pass your details to Trustpilot; anything you post there is covered by Trustpilot’s own terms. You can opt out using the link in that email. Lawful basis: our legitimate interests in improving our courses and letting future learners see what others thought of them.

If you create an account

Your name, email address, password (stored only as a secure hash), and the organisation you join if you use an invitation. Lawful basis: performance of our contract with you.

If your employer invited you

Where an employer invites you onto the platform, we get your email address from them before you have an account with us, so that the invitation can reach you. They may also tell us your name and which team you are in. We only use it to send the invitation and to connect you to their organisation once you accept. Lawful basis: our legitimate interests in operating the invitation, and your employer’s own basis for passing it to us.

If an organisation pays for your training

Most learners buy their own membership, and then our contract is with you. But an organisation can also arrange and pay for a course for its staff. In that case the contract is between us and them, not between us and you, so we do not rely on “performance of a contract with you” for that learning. We process your records to deliver the training the organisation asked us to deliver, and to give them the completion evidence they need. Lawful basis: our legitimate interests, and theirs, in delivering and evidencing workplace training. You can object — see your rights below.

When you agree to start straight away

At checkout you tick a box asking us to start your access immediately. We keep a record that you ticked it: the date and time, your IP address, and which version of the wording you were shown. We keep it because it is the evidence of what you agreed to if a refund is ever disputed — it protects you as much as us. We do not use it for anything else. Lawful basis: our legitimate interests in keeping a reliable record of what was agreed.

When you use a course

Which modules you open and complete, how far through you are, your assessment attempts and scores, the reflections you write at the end of a course, completion dates, and the certificates issued to you together with their verification codes. We need this to deliver the course, decide whether you have passed, and issue and verify certificates. Lawful basis: performance of our contract with you.

When you finish a course

Some courses end with a short feedback form. It asks how you rate the course, how well the website worked for you (with an optional box to report technical or accessibility problems), the type and name of the organisation you work for, your role, roughly how many drivers and passenger assistants work there, and whether we may contact your organisation about training for its team. Your answers are stored with your name, and only our own staff can see them — not your employer, and not anyone else. We use them to improve our courses and the website, to understand which organisations our learners work for, and — only if you say yes — to contact your organisation. Every question about your work can be answered “Prefer not to say”, and the organisation name is optional, so you never have to tell us who you work for to receive your certificate. Lawful basis: our legitimate interests in improving our courses and in offering training to organisations. You can object — see your rights below.

If you tell us we may contact your organisation, we will email it about training for its team. We will say that you suggested us only if you chose that answer. You can change your mind at any time by emailing us, and we will not mention you after that. Lawful basis for telling your organisation that you suggested us: your consent.

When you pay

Our payment provider, Stripe, collects and processes your card details directly. We never see or store your card number. We keep a record of what you bought, the amount, the date and Stripe’s payment reference. Lawful basis: performance of our contract, and legal obligation for accounting records.

Membership is a subscription that renews automatically, so Stripe also holds your card on file to take the next payment, and we store the reference numbers Stripe gives us for your customer and subscription records. We use them for three things and nothing else: to take the renewal, to email you before each renewal telling you the date and the amount, and to let you cancel or change your card from your account. You can cancel at any time, which stops any further payment. Lawful basis: performance of our contract with you.

Technical data

Standard server logs — IP address, browser type, pages requested — used to deliver and secure the service, plus a session cookie that keeps you logged in. Lawful basis: legitimate interests in a secure service.

This website does not use advertising or analytics trackers, and we do not sell your personal data or share it for marketing. The only exception is telling your organisation that you suggested us, and only if you ask us to.

If your employer enrolled you

Where you join an organisation on our platform, that organisation’s administrators can see your name, email address, the learning assigned to you, your completion status and your certificates. They cannot see your password or your individual assessment answers.

If you want to know why your employer requires this, or how long they keep it, ask them — it is their decision, not ours. You are welcome to contact us about how the information moves through our platform, and about your rights over it.

When someone verifies your certificate

Every certificate we issue carries a unique reference, and anyone holding that reference can check it on our website without an account. That is what makes a certificate worth having — an employer needs to be able to confirm it is genuine.

A successful check shows your name, the programme you completed, the date it was issued, and its validity or expiry status where that applies. It shows nothing else: not your email address, not your scores, not your answers, and not any other course you have taken.

The reference is deliberately hard to guess, so in practice only someone you have given the certificate to can look it up. We also limit how many checks can be made from one place in a short time, to stop anyone trying references at random. Lawful basis: legitimate interests in certificates that can be trusted.

If you have a good reason to want your certificate withdrawn from the verification service, email us and we will discuss it with you.

Marking and certificates are automatic

Your progress through a course is tracked automatically, your final assessment is marked automatically, and if you pass — and have submitted any reflection or feedback form the course asks for — your certificate is issued automatically. No person looks at your answers before that happens.

If you believe a result is wrong, email us. A person will look at it, and we will correct it and reissue the certificate if we agree.

How long we keep it

• Enquiries — up to 24 months after we deal with them, unless you ask us to delete them sooner.
• End-of-course feedback — 24 months from the day you submit it, and then it is deleted automatically. A reflection you write as part of a course is a learning record, kept as set out next.
• Account and learning records — for as long as your account is open, and then for 6 years. Training and certification records are evidence of compliance and are routinely requested by employers, auditors and regulators years after the event. While you are a member we keep these to perform our contract. After it ends we keep them under our legitimate interests in maintaining reliable training records, keeping certificates verifiable, and being able to bring or defend a legal claim.
• Payment records — 6 years, as required for accounting and tax.

Who we share it with

• Stripe — payment processing.
• Vercel Inc. — website hosting and security logs.
• Resend — sending service emails such as confirmations and reminders.
• Elestio — managed hosting for the learning platform and its database, running on Netcup infrastructure in Nuremberg, Germany.
• Your organisation’s administrators, if you joined through an employer, as described above.
• The organisation you work for — only if you tell us at the end of a course that we may contact it, and your name only if you say we may mention it.
• Anyone you give a certificate reference to, who can then confirm the certificate is genuine, as described above.
• No one else, unless the law requires it.

Your learning records are stored in Germany. Germany is outside the United Kingdom, but it is covered by UK adequacy regulations, which means the UK government recognises it as providing an equivalent level of protection.

Personal data may sometimes be processed outside the United Kingdom. Where that happens we make sure an appropriate transfer mechanism is in place — UK adequacy regulations, the UK Extension to the EU–US Data Privacy Framework where it applies, or appropriate safeguards such as the UK International Data Transfer Addendum to the EU Standard Contractual Clauses. Ask us if you would like to know which one applies to a particular transfer.

How we protect it

Access to learner data is restricted to staff who need it. Data is encrypted in transit, passwords are stored only as salted hashes, and the platform is backed up. If a breach happens that is likely to put your rights and freedoms at risk, we will report it to the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it. Where a breach is likely to put you at high risk, we will tell you too, without undue delay.

Your rights

You can ask us to give you a copy of your personal data, correct it, delete it, restrict how we use it, or hand it over in a portable format. You can also object to us using it.

Most of these rights are qualified, not absolute. Whether one applies depends on why we are using the data. For example, we may not be able to delete a training record we are keeping to defend a legal claim, and portability only covers data you gave us that we hold by consent or under a contract. If we cannot do what you ask, we will tell you why.

• Where we rely on your consent — such as telling you when you when something launches — you can withdraw it at any time by emailing us, and from any unsubscribe link if we ever start sending marketing. Withdrawing it does not affect anything we did before you withdrew it.
• Where we rely on legitimate interests, you can object. We will stop unless we have compelling grounds to continue.
• For direct marketing, your right to object is absolute. Tell us and we will stop, with no questions asked.

To exercise any right, email info@ukcomplianceacademy.co.uk. We normally respond within one month. Where a request is complex, or you have made several, the law lets us take up to two months longer — we will tell you within the first month if that happens, and why.

Closing your account

Closing your account is not the same as us erasing everything, and it would be misleading to suggest otherwise. We delete what we no longer need. We keep certain learning, payment and certification records for the periods set out above — because we have to for tax, because a certificate you have already given an employer must stay verifiable, and because we may need them to bring or defend a legal claim.

Where we keep something after your account closes, we keep only what is necessary for that purpose and nothing more. If you want your certificate withdrawn from the verification service as well, tell us and we will discuss it with you.

If you are unhappy with how we use your data

Tell us first — email info@ukcomplianceacademy.co.uk with the word “privacy” in the subject line. We will acknowledge your complaint within 30 days and respond without undue delay, telling you what we found and what we have done about it.

You do not have to come to us first, and nothing here stops you going straight to the Information Commissioner’s Office (ico.org.uk), which can investigate how we handle your personal data.

Cookies

This site sets no advertising or analytics cookies. The learning platform sets a session cookie that is strictly necessary to keep you logged in. See our cookie policy for the full detail.

Changes

We update this policy as our services change, and we change the date at the top whenever we do. Where a change affects your rights in a real way — a new purpose, a new recipient, or a longer retention period — we will tell you before it takes effect rather than leaving you to notice the new date.