Privacy

Who holds the account

The account belongs to an adult: the parent, legal guardian or other purchaser. The account email address is the login identifier and the address every message is sent to.

What we store about the adult

We store the account email address, both as you typed it and in a normalised form used for matching. When you buy, we also store the payment first name, last name, email address and phone number returned by the payment provider, together with the parental-authorisation statement you accepted, its version, the time, your IP address and your browser user agent.

Payment details themselves never reach this portal. Card data is handled entirely by the payment provider.

What we store about the learner

Only a first name and a last name. That is the name used inside the portal and printed on the certificate.

• We do not collect a child’s email address.
• We do not collect a child’s phone number.
• We do not collect a child’s date of birth.
• We do not address marketing to a child. Every message goes to the adult account contact.

Security records

Sign-in requests, administrator actions and entitlement changes are recorded in an audit log that keeps the action, the time, the IP address and the browser user agent. Secrets, tokens and one-time codes are never written to it.

Cookies

One cookie, for your session. It is host-only, HttpOnly, restricted to this site with SameSite=Lax, and marked Secure in production. There is no advertising cookie and no third-party analytics cookie on this portal.

How long we keep it

Access and payment records are kept as business records after an account is closed, because they establish what was bought and what was granted. If you ask us to erase personal data, we pseudonymise the account while keeping the payment history required for business and legal records.

Asking us about your data

Write to the address on the help page. We will confirm what we hold about your account and act on correction or erasure requests.