Privacy Policy

How we collect, use and protect your personal data under UK GDPR.

Last updated 19/10/2026

Overview

This Privacy Policy applies to our website, online platform (lcfa.ai), educational services, training programs, mobile applications, communications, and all related services.

What we do

Collect only necessary data for our services
Use data to provide and improve our platform
Protect your data with industry-standard security
Respect your privacy rights and preferences
Comply with UK GDPR regulations

What we don't do

Sell your personal data to third parties
Use your data for unauthorized purposes
Share data without proper safeguards
Keep data longer than necessary
Ignore your privacy rights requests

Legal basis for processing

Contract performance: Account creation and management, course delivery and support, payment processing.
Legitimate interest: Platform improvement, security monitoring, analytics and reporting.
Marketing (legitimate interest, PECR soft opt-in): We email people who give us their details while enquiring about, booking or signing up for our programmes, events and resources, about similar LCFA programmes. If you give a UK mobile number, we may also text you. You can refuse when you sign up ("No thanks"), unsubscribe from any email, and email us to stop texts.

Personal Data We Collect

Account registration

Full name
Email address
Phone number (if provided)
Password (encrypted)
Profile picture (optional)
Career goals and objectives
Professional background
Learning preferences

Webinar and scorecard sign-ups

Full name
Email address
Location (webinars)
Phone number (optional)
Scorecard answers and score

If you give a phone number, we may text you about your registration, your report or a call you book.

Payment and billing

Billing name and address
Payment method details (via Stripe)
Transaction history
Subscription preferences
Receipts and invoices
Refund records

Stripe processes payment data. We do not store full card numbers on our servers.

Technical and usage

IP address and location
Browser type and version
Device information
Session duration
Course progress and completion
Feature usage metrics
Login history
Video watch time

From third parties

Google OAuth: basic profile information (name, email), profile picture (if authorized), account verification status
Stripe: payment confirmation data, fraud prevention indicators, transaction success or failure status

How We Use Your Data

Service delivery

Account management and authentication
Providing educational content
Progress tracking and completion
Customer support and assistance
Issuing certificates and credentials
Community forum participation

Payment processing

Processing payments through Stripe
Generating invoices and receipts
Managing subscription billing
Handling refunds and cancellations
Tax compliance and reporting
Fraud prevention and security

Platform improvement

Understanding user behavior
Developing new features
Improving educational content
Performance monitoring
Security enhancement
User experience optimization

Communications

Service updates and announcements
Educational content and promotions
Support and assistance
Text messages, if you give a UK mobile number
Privacy policy updates
Community interactions
Legal notices

Our service providers

We only share data with these providers. We never sell your personal data.

Stripe: Payments and billing.
Google: Sign-in, calendar invites and Meet links for webinars, and Analytics (GA4) for site usage.
Resend: Account and system emails.
Autosend: Email delivery and contact lists, including reports, webinar reminders and programme news.
Cal.com: Booking calls.
ClickUp: Lead follow-up tasks and our internal records.
Neon (PostgreSQL): Our database.
Vercel: Hosting this website.
Upstash: Background jobs, and rate limiting that protects forms.
Tigris: Storage for uploaded files.
Mux: Course video hosting and playback.
Cloudflare R2: Database backups, in an EU bucket.
Contabo: Hosting our lead follow-up system.
Twilio: Booking reminders and follow-ups by SMS, to UK mobile numbers.

Some of these providers are based in the US, so your data may be stored there. We rely on the safeguards in each provider's own data processing terms.

Your Data Protection Rights

Under UK GDPR, you have these rights. We respond within 30 days. For complex requests, we may extend this by up to 60 days and will tell you.

Right of Access: Request copies of your personal data and understand how it's being processed.; How: Account Settings or contact us
Right to Rectification: Correct inaccurate personal data and complete incomplete information.; How: Update Account Settings
Right to Erasure (Right to be Forgotten): Delete personal data when no longer necessary or withdraw consent.; How: Account Deletion or contact us
Right to Data Portability: Receive your personal data in machine-readable format or transfer to another service.; How: Contact us
Right to Object: Object to processing based on legitimate interest, including marketing emails. Say "No thanks" when you sign up or unsubscribe from any email.; How: Unsubscribe links or contact us
Right to Restrict Processing: Limit how we use your data while we verify accuracy or review objections.; How: Contact us

Data Security and Protection

Technical safeguards

Data encrypted in transit and at rest
Multi-factor authentication
Firewalls and intrusion detection
Regular security updates
Secure backup systems

Organizational measures

Staff data protection training
Need-to-know access policies
Incident response procedures
Vendor due diligence
Regular security audits

Account data retention

Active accounts: account duration + 7 years
Closed accounts: 30 days after closure
Authentication logs: 2 years

Educational data retention

Course progress: 7 years after completion
Certificates: permanently (for verification)
Assessment results: 7 years

Data breaches

If a data breach happens, we will contain and assess it within 24 hours, notify authorities within 72 hours if required, and inform affected individuals without undue delay.

Contact Us

For privacy questions, data rights requests or general support, email our Data Protection Officer at support@lcfa.ai.

Complaints

You can complain to the Information Commissioner's Office (ICO), the UK data protection authority.

Website: ico.org.uk
Phone: 0303 123 1113
Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

LCFA