Privacy Policy

Black & White Academy Ltd is the data controller for the personal data collected through this website and in connection with our courses and services. We are registered in England and Wales under Company Number 15762031.

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us at: info@blackandwhiteacademyltd.com.

We collect personal data that you provide directly to us, including: your full name, email address, telephone number, postal address, date of birth (where required for accredited courses), payment information, and any additional information you provide when completing a booking form, enquiry, or registration.

When you use our website, we may also collect technical data automatically, including: your IP address, browser type and version, operating system, referring URLs, pages visited, time and date of visits, and cookie identifiers. This data is collected via cookies and similar technologies — please see our Cookie Policy for full details.

If you create a student portal account, we collect your login credentials (email address and hashed password), course progress data, and any certificates or records associated with your enrolment.

We do not knowingly collect personal data from children under the age of 16 without verifiable parental or guardian consent. If you believe we have inadvertently collected such data, please contact us immediately.

We use your personal data for the following purposes:

• To process your course enrolment, booking, or appointment and send you confirmation and related communications.

• To manage your student portal account and track your course progress and certificates.

• To process payments and manage any payment plans agreed with you.

• To communicate with you about your course, including updates, schedule changes, and important notices.

• To comply with our legal obligations, including safeguarding duties, awarding body requirements, and financial record-keeping.

• To send you marketing communications about our courses and services, where you have given your consent or where we have a legitimate interest in doing so. You may opt out at any time.

• To improve our website and services through analytics and user behaviour data (subject to your cookie preferences).

We process your personal data on the following lawful bases under UK GDPR:

• Contract: processing is necessary to fulfil our contract with you (e.g. processing your enrolment and delivering your course).

• Legal obligation: processing is necessary to comply with a legal obligation (e.g. safeguarding, financial records, awarding body requirements).

• Legitimate interests: processing is necessary for our legitimate interests in running and improving our business, provided those interests are not overridden by your rights.

• Consent: where we rely on your consent (e.g. for marketing emails or non-essential cookies), you may withdraw that consent at any time by contacting us at info@blackandwhiteacademyltd.com or by using the unsubscribe link in any marketing email.

We do not sell, rent, or trade your personal data. We may share your data with trusted third parties only where necessary, including:

• Awarding bodies and accreditation organisations (e.g. City & Guilds) where required to register you for a qualification or submit assessment records.

• Payment processors (Stripe) to securely process course fees and deposits. We do not store your full card details.

• IT and software service providers who host our website, student portal, and booking system, under strict data processing agreements.

• Government bodies, regulators, or law enforcement agencies where we are legally required to do so.

All third parties we work with are required to handle your data securely and in accordance with UK GDPR. We do not transfer your personal data outside the UK or EEA without appropriate safeguards in place.

We retain your personal data only for as long as necessary for the purposes for which it was collected, or as required by law. Our standard retention periods are:

• Course enrolment and financial records: 7 years from the date of enrolment, in line with HMRC requirements.

• Student portal accounts: for the duration of your active enrolment plus 3 years, after which your account will be deactivated and data anonymised unless you request earlier deletion.

• Marketing communications: until you withdraw your consent or opt out.

• Website analytics data: up to 26 months, in line with standard analytics retention practices.

When data is no longer required, it is securely deleted or anonymised.

Under UK GDPR, you have the following rights in relation to your personal data:

• Right of access: you may request a copy of the personal data we hold about you (a Subject Access Request).

• Right to rectification: you may ask us to correct inaccurate or incomplete data.

• Right to erasure: you may ask us to delete your personal data where there is no longer a lawful basis for us to hold it.

• Right to restrict processing: you may ask us to pause processing of your data in certain circumstances.

• Right to data portability: you may request your data in a structured, machine-readable format.

• Right to object: you may object to processing based on legitimate interests or for direct marketing purposes.

• Rights related to automated decision-making: we do not use automated decision-making or profiling that produces legal or similarly significant effects.

To exercise any of these rights, please contact us at info@blackandwhiteacademyltd.com. We will respond within one calendar month. You will not be charged a fee for making a request unless it is manifestly unfounded or excessive.

We take the security of your personal data seriously. We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, destruction, or alteration. These measures include encrypted data transmission (HTTPS), hashed password storage, restricted staff access, and regular security reviews.

Whilst we take every reasonable precaution, no method of transmission over the internet is completely secure. If you believe your data has been compromised, please contact us immediately at info@blackandwhiteacademyltd.com.

We use cookies and similar tracking technologies on our website. For full details of the cookies we use, their purpose, and how to manage your preferences, please read our Cookie Policy.

If you are unhappy with how we have handled your personal data, please contact us in the first instance at info@blackandwhiteacademyltd.com and we will do our best to resolve your concern.

You also have the right to lodge a complaint with the UK's data protection supervisory authority, the Information Commissioner's Office (ICO), at any time. You can contact the ICO at www.ico.org.uk or by calling 0303 123 1113.

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The current version will always be published on this page with the date it was last reviewed. We encourage you to check this page periodically.

Continued use of our website or services after any update constitutes your acceptance of the revised policy.