§1 Who we are
TPG TRAINING ACADEMY LTD (company number 16424369, registered office 15 St Botolph Street, London, EC3A 7BB) runs this website and decides how and why your personal data is used. That makes us the controller of your data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. For anything in this policy, email hello@tpg-training-academy.co.uk.
§2 What we collect and why
We collect personal data from you directly: what you type at checkout or in the chat, and the technical details your browser sends when it asks for a page. The only thing we work out ourselves is the country of a visit, from its IP address. The table sets out each use, the data involved, our lawful basis under Article 6 of the UK GDPR and how long we keep it.
| Purpose | Data | Lawful basis | How long |
|---|---|---|---|
| Taking your order, sending your access details and dealing with questions about the order | First and last name, email address, company name (if given), billing address and country; the courses ordered, prices, order reference, date and status; messages about the order | Contract; keeping the record afterwards is a legal obligation | 6 years from the end of the financial year in which you ordered, for our tax and accounting records |
| Customer support chat | Your messages, any files you attach, your email address if you choose to give it, the page you were on when you wrote, and a random identifier for the conversation | Legitimate interests in answering the questions you send us; steps you ask for before buying | Deleted 12 months after the last message in the conversation |
| Visit log, for security and fraud prevention | Time of the request, IP address, country, page requested, referring page and browser description | Legitimate interests in keeping the site and its customers secure and in finding faults | 90 days, then deleted automatically |
| Remembering your checkout details on your device | The checkout details you entered, stored in the buyer cookie, only if you tick the box to remember them |
Consent | 180 days, or until you withdraw consent with the “Forget my details” link on the checkout or by deleting your cookies |
Where we rely on legitimate interests, we have weighed them against your interests and rights: the data involved is limited, it is used only for the purpose stated, and it is deleted on the schedule above. You can object at any time (§6).
You do not have to give us your details, but we need the checkout details to sell you a course and send your access. The chat works without an email address.
§3 Who receives your data
We share personal data only with these categories of recipient, and only what each needs:
- Our payment service provider, which acts as merchant of record for the sale. It receives your name, email address, company name (if given), billing address and the order lines and amounts, and collects your card or wallet details itself on the secure payment page. For the payment it decides how your data is used, and its own privacy notice applies.
- Our hosting and email providers, which store the website, order records, chat and visit log and carry our email, acting on our instructions.
- An IP-location service, which receives IP addresses from the visit log, and nothing else, so that it can tell us the country of a visit in our admin log.
- Content delivery networks that serve the web fonts, photographs and payment-method icons on our pages. Your browser fetches these directly, so they receive your IP address and browser details. They are listed on the Cookies page.
- Our accountants and public authorities, where we need professional help with our records or where the law requires us to disclose information.
We do not sell your personal data, and we do not share it for advertising.
§4 International transfers
Some of these providers may process data outside the United Kingdom. Where they do, the transfer relies on UK adequacy regulations for the country concerned or, where there are none, on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, approved for this purpose in the UK. You can ask us for more detail about the safeguards for a particular transfer.
§5 Security, decisions and sale of data
The site is served over an encrypted connection, the support desk and logs are open only to signed-in staff, and order records and chat files are kept in storage that cannot be reached from the web. Your order page has a long, unguessable address: anyone who has that address can see the order, so keep it to yourself.
We make no decisions about you by automated means alone, including profiling, that have legal or similarly significant effects. We do not sell personal data.
§6 Your rights
Under the UK GDPR you have the right to:
- have access to the personal data we hold about you and receive a copy of it;
- have inaccurate data corrected (rectification) and incomplete data completed;
- have your data erased, where there is no good reason for us to keep it;
- ask us to restrict how we use your data while a question about it is resolved;
- object to our use of your data where we rely on legitimate interests;
- receive the data you gave us in a structured, machine-readable form, or have it sent to another organisation (portability), where we use it on the basis of contract or consent;
- withdraw your consent at any time, where we rely on consent; this does not affect what we did before.
To use any of these rights, email hello@tpg-training-academy.co.uk. There is no charge. We may need to confirm who you are before acting, and we reply within one month. Some rights are limited: for example, we must keep order records for the period in §2 even if you ask us to delete them.
§7 Complaints
If you are unhappy with how we have used your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office, the UK’s data protection regulator: ico.org.uk, telephone 0303 123 1113.
§8 Changes to this policy
We will update this policy when the way we use personal data changes, and the date at the top of the page shows the latest version. If a change affects data we already hold about you in a significant way, we will tell you by email before it takes effect where we have your address.