UK Compliance Academy

UK Compliance Academy Limited ("we", "us") is the data controller for this learning platform. UK Compliance Academy Limited, registered in England and Wales (company number 17309952), registered office 128 City Road, London, EC1V 2NX, United Kingdom. Contact: info@ukcomplianceacademy.co.uk.

What we collect and why

• Account data — your name, email address and password (stored hashed). Legal basis: contract (providing your account).
• Learning records — course enrolments, progress and interaction data from learning modules (including SCORM tracking), completion dates and certificates issued. Legal basis: contract, and our legitimate interest in maintaining accurate learning records. Compliance learning records may also be retained to help you and your employer evidence statutory learning duties.
• Organisation membership — if you join through an employer's invitation or join code, we record which organisation you belong to. Your organisation's managers can see your name, email address, learning assignments, progress status, completion dates and certificates for the courses the organisation assigns. They cannot see any personal learning you undertake outside their assignments. Legal basis: legitimate interests of you and your employer in managing workforce compliance.
• Payment records — if you buy a membership or seats, payment is processed by Stripe. We store the order (amount, date, what was purchased) but never your card number. Legal basis: contract and legal obligation (accounting).
• Emails — transactional email (password resets, confirmations, expiry reminders) is delivered by Resend. Invitation emails from organisation managers are sent from the manager's own email account, not by us.
• Technical data — server logs (IP address, browser, pages requested) to run and secure the service. Legal basis: legitimate interests.

We do not use advertising or analytics trackers, and we never sell your personal data.

How long we keep it

Your account and learning records are kept while your account is active. Certificates and completion records are retained so they remain verifiable for compliance purposes. If you ask us to delete your account, we erase or anonymise your personal data unless we must retain specific records to meet a legal obligation.

Who we share it with

• Your organisation's managers (learning records for organisation-assigned courses only), if you belong to one.
• Stripe (payment processing), Resend (email delivery), and our hosting provider (infrastructure). Where these providers process data outside the UK, transfers are protected by appropriate safeguards such as the UK Addendum to the EU Standard Contractual Clauses.
• No one else, unless the law requires it.

Your rights

You may access, correct, export, delete or restrict the personal data we hold about you, object to processing, and withdraw consent where processing is based on consent. Use the "Contact the privacy officer" and data request links on your profile page, or email info@ukcomplianceacademy.co.uk. You may also complain to the Information Commissioner's Office (ico.org.uk).