Legal
Privacy policy
Who we are
Herpetological & Wildlife Academy is operated by Wright's Reptiles, Address to be confirmed, United Kingdom (“we”, “us”). We are the data controller for the personal data described here. Contact us about privacy at hello@example.co.uk.
What we collect and why
| Data | Purpose | Lawful basis (UK GDPR Art. 6) |
|---|---|---|
| Name, email, password (hashed) | Create and run your student account; show your name on certificates | Contract |
| Purchases and payment references | Provide the courses you buy; accounting and tax records | Contract; legal obligation |
| Lesson progress, quiz and assessment answers and scores, certificates | Deliver the course, assess learning, issue and verify certificates | Contract |
| Consent records (checkout acknowledgement, marketing opt-ins) | Evidence that we obtained valid consent | Legal obligation; legitimate interests |
| Marketing email preferences and interests | Send news, free lessons and offers you asked for | Consent — withdraw any time |
| Team membership, seat assignments and training progress (team learners) | Run the team licence your organisation bought; let its managers see your progress, scores and certificates as training records | Contract (with your organisation); legitimate interests |
| Contact form messages | Reply to your enquiry | Legitimate interests |
| Analytics (only if you accept) | Understand which pages are useful | Consent |
We do not see or store your card details — payments are processed by Stripe.
Team accounts
If you join through an organisation's team licence, the managers of that team can see your name, email, lesson progress, assessment scores, certificates and when you were last active. They cannot see your answers to individual questions or your other purchases. If you leave the organisation, ask a manager to remove you or contact us.
Who we share data with
We use trusted processors who act on our instructions under data processing agreements:
- Supabase — database, authentication and file storage (hosted in [London, UK / EU region]).
- Vercel — website hosting and, if you consent, privacy-friendly analytics.
- Stripe — payment processing. Stripe is also an independent controller for fraud prevention.
- [Email provider, if used for newsletters]
- [Video host — e.g. Vimeo — if used]
Some processors may transfer data outside the UK. Where they do, transfers are protected by UK adequacy regulations or the UK International Data Transfer Addendum / Agreement.
How long we keep data
- Account, progress and certificates: while your account is open. Delete your account at any time.
- Order records: 6 years after the end of the financial year, as required by HMRC.
- Consent records: for as long as we rely on the consent, plus 6 years.
- Contact messages: up to 2 years.
- Mailing list: until you unsubscribe.
Your rights
You have the right to access, correct, delete, restrict or object to the use of your data, and to data portability. You can download all your data and delete your account yourself from Account & privacy, or email us. We will respond within one month. You can withdraw marketing consent at any time using the link in any email or in your account.
If you are unhappy with how we handle your data, please tell us first. You can also complain to the Information Commissioner's Office: ico.org.uk.
Security
Data is encrypted in transit (HTTPS) and at rest. Access to course content and student records is restricted by database-level security rules. Course videos and downloads are delivered through short-lived signed links.
Children
Our courses are intended for adults. Under-18s should only register with permission from a parent or guardian.