Privacy Policy

ExSell Academy (“we”, “us”, “our”) is committed to protecting your privacy. This policy explains what personal data we collect when you use https://www.exsellacademy.co.uk, our courses and our services, how we use it, the lawful bases we rely on, and the rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We act as a data controller in respect of the personal data described below. For matters relating to learning, certification and recruitment, we may also share data with employers and sponsors as described in this policy.

1. Information we collect

• Account & identity data — your name, email address, password (stored only as a salted scrypt hash, never in plain text) and the role you join as (learner, employer or sponsor).
• Application data — information you provide when applying for a funded place, such as your age, location, education and employment status, career goals and any support needs you choose to share.
• Learning data — your course progress, assessment results and certificates earned.
• Communications — messages you send us by contact form or email.
• Technical & usage data — the IP address a contact form was submitted from (kept for 30 days to investigate abuse). We do not run analytics or tracking unless you accept analytics cookies; if you choose “Essential only”, none is collected.

2. How and why we use your data

We use your personal data to provide and improve our services, specifically to:

• create and manage your account and deliver your courses;
• assess and process applications for funded training places;
• issue and verify CPD certificates and share certified outcomes with employers and sponsors where you have asked us to or consented;
• respond to your enquiries and provide learner and partner support;
• send you service and, where you have opted in, marketing communications; and
• maintain the security of our platform and meet our legal and regulatory obligations.

3. Lawful bases

We only process personal data where we have a lawful basis to do so under Article 6 UK GDPR. Depending on the activity, we rely on:

• Contract — to deliver the courses and services you sign up for.
• Consent — for optional marketing, and for sharing your details with employers or sponsors. You can withdraw consent at any time.
• Legitimate interests — to improve and secure our services and understand how they are used, balanced against your rights.
• Legal obligation — where we are required to retain or disclose data by law.

Where you share special category information (for example, safeguarding or support needs), we process it only with your explicit consent and to provide appropriate support.

4. Sharing your data

We do not sell your personal data. We share it only with: service providers who help us run the platform (such as hosting, email and analytics providers) under appropriate contracts; employers and sponsors where you have consented as part of our recruitment and funding services; and authorities where we are legally required to do so. Any transfers outside the UK are protected by appropriate safeguards such as UK adequacy regulations or standard contractual clauses.

5. Data retention

We keep personal data only for as long as necessary for the purposes set out above. These periods are enforced automatically by a scheduled deletion job, not applied by hand:

• Contact enquiries — deleted after 2 years. The IP address recorded with an enquiry is erased after 30 days.
• Unsuccessful applications — deleted 2 years after the decision.
• Account and learning records — retained for the duration of your relationship with us. You can ask us to erase them at any time.
• Certificate records — retained so employers can continue to verify a certificate you have been awarded.
• Administrative audit records — retained for 7 years as a record of decisions affecting learners and funding.

6. Your rights

Under UK GDPR you have the right to access your data, to have inaccurate data corrected, to request erasure, to restrict or object to processing, to data portability, and to withdraw consent where processing is based on consent. To exercise any of these rights, contact us using the details below. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.

7. Cookies

We use strictly necessary cookies to operate the site — one to keep you signed in, and one to remember your cookie choice. These do not require consent because the site cannot function without them.

Anything else is only set if you choose “Accept all” in our cookie banner. If you choose “Essential only”, no analytics or tracking cookies are set at all. You can change your choice at any time by clearing the exsell_consent cookie in your browser, which will show you the banner again.

8. Children and young people

Our services are aimed at school leavers and emerging professionals, so we know young people use them. You must be at least 16 to create an account, and we ask for your date of birth at registration to check this. We do not knowingly create accounts for under-16s.

Where an application includes safeguarding information, access is restricted to staff who need it for that purpose and every access decision is recorded in our audit log. If you believe someone under 16 has created an account, contact us at privacy@exsellacademy.com and we will delete it.

9. Contact us

If you have any questions about this policy or how we handle your data, please contact us at hello@exsellacademy.com.

See also our Terms of Service.