Privacy Policy
1. Introduction
Course Plus Ltd ("Course Plus", "we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains what personal data we collect when you use courseplus.co.uk (the "Platform"), why we collect it, how we use it, and the rights you have over it.
This policy applies to individual learners, company administrators and employees using a Team Training account, and visitors browsing the Platform without an account.
2. Who we are
Course Plus Ltd is registered in England & Wales, with its registered office in London, United Kingdom. Course Plus Ltd is the data controller responsible for your personal data under UK data protection law.
3. Information we collect
Information you give us
- Account details: name, email address, password (stored securely, never in plain text)
- Billing details: billing address and payment information (processed by our payment provider, Stripe — we do not store full card numbers)
- Company details (Team Training accounts): company name, admin contact details, employee email addresses you invite
- Support communications: anything you send us via our contact form or support email
Information collected automatically
- Course progress: enrolments, lesson completions, quiz results, certificates issued
- Usage data: pages visited, device and browser type, approximate location (from IP address)
- Cookies and similar technologies (see Section 7)
4. How we use your information
- To create and manage your account, and provide access to purchased courses
- To process payments and send order confirmations and receipts
- To issue and verify CPD QC accredited certificates
- To operate Team Training accounts, including sharing an employee's progress data with their company administrator
- To respond to support requests
- To send service-related communications, and marketing communications where you've consented to receive them
- To improve the Platform, detect fraud, and maintain security
5. Our legal basis for processing
Under UK GDPR, we rely on the following legal bases depending on the activity:
- Contract: processing needed to provide the course access and services you've purchased
- Legitimate interests: improving the Platform, preventing fraud, and operating Team Training accounts on behalf of a paying company
- Consent: marketing emails and non-essential cookies, which you can withdraw at any time
- Legal obligation: retaining certain records (e.g. financial records) as required by law
6. Who we share data with
We do not sell your personal data. We share data only where necessary, with:
- Payment processing: Stripe, to process card payments securely
- Hosting & infrastructure providers: to run the Platform and store course/video content
- Company administrators: if you're enrolled through a Team Training account, your progress and completion data is visible to your company's administrator
- Regulators or authorities: where required by law
8. Data retention
We retain personal data for as long as your account is active, and for a reasonable period afterwards to comply with legal, accounting, and accreditation record-keeping obligations. Certificate records are retained indefinitely to support ongoing employer verification requests, unless you request erasure and no legal obligation requires us to retain them.
9. Your rights
Under UK GDPR, you have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request erasure of your data, where applicable
- Object to or restrict certain processing
- Request a portable copy of your data
- Withdraw consent at any time, where processing is based on consent
- Lodge a complaint with the UK Information Commissioner's Office (ICO) if you believe your data has been mishandled
To exercise any of these rights, contact us using the details in Section 14.
10. International transfers
Where any of our service providers process data outside the UK, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses, to protect your data to UK standards.
11. Children's privacy
The Platform is intended for professional and workplace learners. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us so we can remove it.
12. Security
We use industry-standard technical and organisational measures to protect your data, including encryption in transit, access controls, and secure payment processing via Stripe. No system is completely secure, and we encourage you to use a strong, unique password for your account.
13. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be notified via email or a prominent notice on the Platform. The "Last updated" date at the top of this page reflects the most recent revision.
14. Contact us
If you have questions about this Privacy Policy or how we handle your data, contact us at privacy@courseplus.co.uk, or via our Contact page.