1. Introduction
Academy by Carnaby ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and protect your personal data when you visit our website or purchase our digital products, including the Foundation course and QSPro software access (collectively, the "Service").
2. Data We Collect
We may collect and process the following categories of personal data:
- Contact information: name and email address provided at checkout or when contacting us.
- Payment information: processed securely by our payment provider. We do not store full card details.
- Usage data: information about how you interact with our website, including IP address, browser type, and pages visited, collected via cookies and analytics tools.
- Account data: if you create an account, your login credentials and preferences.
3. How We Use Your Data
We use your personal data to:
- Process and fulfil your purchases, including delivering course materials and access codes.
- Provide customer support and respond to your enquiries.
- Send you important service notifications and, where you have opted in, marketing communications.
- Analyse website usage to improve our Service and user experience.
- Comply with our legal and regulatory obligations.
4. Legal Basis for Processing
We process your personal data under the following lawful bases: (a) performance of a contract with you (to deliver your purchase); (b) our legitimate interests in operating and improving our business; and (c) compliance with legal obligations.
5. Cookies
We use cookies and similar technologies to operate and improve our website. Cookies are small files stored on your device. We use essential cookies to enable core functionality, and analytics cookies to understand how visitors use our site. You can manage or reject non-essential cookies via the cookie consent banner on our website or through your browser settings. For more detail, see our Terms & Conditions.
6. Data Sharing
We do not sell your personal data. We may share your data with trusted third-party service providers who help us operate the Service, including our payment processor, email delivery provider, and analytics platform. These providers are bound by confidentiality obligations and only process data on our behalf.
7. Data Retention
We retain your personal data only for as long as necessary to fulfil the purposes described in this policy, including legal, accounting, or reporting requirements.
8. Your Rights
Under the UK GDPR and Data Protection Act 2018, you have the right to:
- Access the personal data we hold about you.
- Request correction of inaccurate data.
- Request erasure of your personal data ("right to be forgotten").
- Object to or restrict certain processing.
- Withdraw consent at any time (where processing is based on consent).
- Lodge a complaint with the Information Commissioner's Office (ICO).
To exercise any of these rights, please contact us through the details on our website.
9. Data Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse. However, no method of transmission over the internet is completely secure, and we cannot guarantee absolute security.
10. Changes to This Policy
We may update this Privacy Policy from time to time. We will post any changes on this page with a revised "Last updated" date. We encourage you to review this page periodically.
11. Contact
If you have any questions about this Privacy Policy or how we handle your data, please contact us through the details provided on our website.