Privacy Policy

1. Who We Are and Scope of This Privacy Policy

1.1 Who we are.

Wisfy Ltd is a company registered in England and Wales and trades as Wisfy.com (“Wisfy”, “we”, “us” or “our”).

For the purposes of applicable data protection law, Wisfy Ltd is the data controller of the personal data processed through or in connection with the Services. This means we determine the purposes and means of processing your personal data and are responsible for how it is handled.

Our registered address and contact details for privacy-related enquiries are set out in Section 17 (Contact Details).

1.2 What this Privacy Policy applies to

This Privacy Policy applies to personal data processed through or in connection with our websites (including Wisfy.com), mobile applications, community features, communities, creator and instructor tools, APIs, customer support channels, marketing activities, events, and any related products or services that link to or refer to this Privacy Policy (together, the “Services”).

This Privacy Policy also applies to any new or additional products, tools, features, community areas, instructor services, or business functions that we may develop, launch, or provide from time to time, unless we state otherwise or provide a separate privacy notice for that specific offering.

1.3 Who this Privacy Policy applies to

This Privacy Policy applies to personal data relating to individuals who interact with us or the Services, including:

• visitors to our websites or platforms;
• account holders, students and learners;
• instructors, creators and contributors;
• applicants for instructor, creator, employment, contractor, or other roles;
• customers and prospective customers;
• suppliers, contractors, and other business contacts; and
• any other individuals who use, access, engage with, or otherwise provide personal data to us in connection with the Services.

This Privacy Policy also applies where we process personal data about individuals whose information has not been provided directly by them, for example where another user refers them, gifts a product to them, invites them to the Services, or otherwise provides their information to us.

1.4 Relationship with other terms

This Privacy Policy should be read together with our Terms of Service, Instructor Terms, cookie notice or cookie settings tools, and any other policies or notices that apply to particular parts of the Services. Where a separate privacy notice is provided for a specific activity, product, feature, campaign, recruitment process or jurisdiction, that notice will also apply to the extent relevant.

1.5 Scope limitations

This Privacy Policy applies where Wisfy acts as the data controller of your personal data. It also describes certain processing carried out on our behalf by service providers acting as processors under our instructions.

In some circumstances, another party may act as an independent controller of your personal data in connection with the Services. This may include, for example, a third-party payment provider, social login provider, or instructor processing your data under their own terms and for their own purposes. In those cases, that party’s own privacy notice will apply to its processing of your personal data, and Wisfy is not responsible for its data handling practices.

In other circumstances, we may process personal data on behalf of another controller, such as an organisation, institution, or business partner. In those cases, that controller’s privacy notice or terms may also apply.

1.6 Third-party services and external links

The Services may contain links to, or integrate with, third-party websites, plugins, payment providers, social media services, embedded content, or other services that we do not own or control. This Privacy Policy does not apply to the privacy, security, or data handling practices of those third parties, and we encourage you to review their privacy information before providing personal data to them.

1.7 Use of the Services

By accessing, registering for, or using the Services, or by otherwise submitting personal data to us, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with this Privacy Policy or the applicable terms governing the Services, you should not access or use the Services.

Your acknowledgement of this Privacy Policy does not by itself mean that you have consented to the processing of your personal data. Where we rely on consent as a legal basis, we will seek it separately in accordance with applicable law.

2. Personal Data We Collect

We collect personal data when you use, access, interact with, or otherwise engage with the Services. The personal data we collect depends on how you interact with us, the role in which you use the Services, and the features you use.

We may collect personal data directly from you, automatically through your use of the Services, and from third parties. Not every category listed below will apply to every individual; we collect the personal data that is relevant to the particular interaction, service, or feature involved.

The categories of personal data we may collect are described in the sub-sections below.

2.1 Account and Registration Data

When you create an account or otherwise register to use the Services, we may collect personal data such as your name, email address, username, password, account preferences, country, language preference, and any other information you provide during registration or account set-up.

If you register or sign in using a third-party service, such as Google, Apple, or Facebook, we may also receive certain information from that provider, as described in 2.9.

2.2 Profile and Creator Data

We may collect profile information that you choose to provide, such as your profile photograph, biography, display name, links to external websites or social media profiles, areas of interest, teaching categories, professional background, and any other information you add to your account or public profile.

If you are an instructor, creator, or contributor, we may also collect information relating to your instructor or creator profile, application, onboarding status, course portfolio, credentials, qualifications, promotional materials, and other information you submit in connection with offering content through the Services.

Depending on the feature and your settings, some profile information may be visible to other users or publicly accessible on the internet.

2.3 Transaction, Billing and Purchase Data

If you make a purchase or other transaction through the Services, we may collect or receive personal data relating to that transaction, including your billing name, billing address, email address, transaction amount, transaction date, currency, purchase history, subscription status, order records, and limited payment-related information, such as the last four digits of your payment card.

Full payment card details are collected and processed directly by our third-party payment providers (e.g. Stripe, PayPal) in compliance with PCI-DSS (Payment Card Industry Data Security Standards). We do not store this information on our own systems.

2.4 Instructor Pay-out and Financial Data

If you are an instructor, creator, or other payee, we may collect and process personal data needed to administer pay-outs, maintain accounting and financial records, and meet related compliance obligations. This may include your billing or business contact details, pay-out method, bank account or payment account details, payment email address, payment history, invoicing information, tax identification numbers, residency information, and any other information reasonably required to process amounts due to you and maintain financial records.

We may also collect information needed for identity verification, fraud prevention, compliance screening, and tax-related compliance. In some cases, this information may be collected by trusted third-party providers acting on our behalf, such as pay-out processors or tax compliance service providers. The collection, use, and disclosure of pay-out or tax-related data may also be subject to the terms and privacy notices of the relevant third-party provider.

2.5 Content, Communications and Community Data

We may collect personal data contained in content that you upload, submit, publish, send, or otherwise make available through the Services. This may include course materials, assignments, images, videos, audio, comments, reviews, ratings, community posts, messages, support enquiries, survey responses, competition or promotion entries, and other user-generated content.

We may also collect personal data contained in your communications with us, including customer support requests, emails, feedback, and other correspondence.

Information posted in public areas of the Services may be visible to other users and may be publicly accessible. For more information, see Section 7.

2.6 Usage, Activity and Learning Data

We may collect information about how you use the Services, including pages viewed, links clicked, searches performed, courses browsed or purchased, course progress, lesson completion, watch history, time spent on content, interaction with emails or notifications, session duration, referral source, and other usage or engagement information.

Where relevant, this may also include information relating to your participation in community features, moderation history, saved preferences, wish lists, and interactions with platform tools or support features.

We may also use third-party analytics and session replay tools to help us understand how users interact with the Services and to improve performance, usability, and support. These tools may record information such as clicks, navigation patterns, scrolling behaviour, and time spent on pages. Sensitive input fields, such as passwords and payment information, are excluded from session replay capture where technically feasible.

2.7 Device, Technical and Log Data

When you access or use the Services, we may automatically collect technical and log information such as your IP address, browser type, device type, operating system, screen resolution, language settings, referral URLs, date and time of access, crash data, unique device or browser identifiers, and other technical information reasonably necessary to operate, secure, maintain, and improve the Services.

We may also derive your approximate geographic location, such as your country, region, or city, from your IP address. We do not collect precise GPS-based location data through the Services.

2.8 Cookies and Similar Technologies

We and our third-party partners may collect personal data through cookies, pixels, tags, web beacons, SDKs, local storage, and similar technologies. This may include identifiers, device and browser information, preferences, authentication status, usage information, and information about your interactions with the Services and, where relevant, with our marketing communications.

For more information about the types of cookies and similar technologies we use, the purposes they serve, and how you can manage your preferences, see Section 9 (Cookies and Similar Technologies).

2.9 Data from Third Parties

We may receive personal data about you from third parties, including the following:

(a) Social login and single sign-on providers

If you register or sign in through a third-party account, such as Google, Apple, Facebook, or another supported login service, we may receive information such as your name, email address, profile image, and a unique account identifier. The information we receive depends on your settings with that provider, and you should review those settings to understand what may be shared with us.

(b) Payment and fraud-prevention providers

We may receive transaction confirmations, limited billing information, payment status information, fraud signals, and related records from payment processors and other service providers involved in payments, account protection, or fraud prevention.

(c) Analytics, advertising, hosting, support, security, and integration providers

We may receive technical, usage, and event data from service providers that support analytics, advertising, hosting, content delivery, security, customer support, embedded content, or similar operational functions.

(d) Marketing and advertising partners

We may receive information from marketing, advertising, or referral partners, such as information about how you interacted with a promotion, advertisement, or referral link that directed you to the Services.

(e) Other users or third parties

We may receive personal data about you where another user invites you to the Services, gifts a product to you, refers you to us, reports content or conduct involving you, or otherwise interacts with us in a way that involves your information.

The personal data we receive from third parties depends on the relevant source, your settings with that third party, and the nature of the relevant service or integration. We process third-party data in accordance with this Privacy Policy.

2.10 Application, Business Contact and Recruitment Data

If you apply to work with us, provide services to us, or otherwise communicate with us in a business capacity, we may collect personal data such as your contact details, CV or résumé, work history, qualifications, correspondence, references, interview records, role-related information, and any other information relevant to recruitment, supplier onboarding, contract management, or the administration of a business relationship.

Where we carry out recruitment or onboarding, we may also receive personal data from third parties, such as recruitment agencies, referees, or background check providers, where permitted by law.

If we provide a separate privacy notice for a particular recruitment process, application, or business engagement, that notice will apply in addition to this Privacy Policy.

2.11 Special Category Data and Sensitive Information

We do not intentionally require users to provide special category personal data through the ordinary use of the Services. This includes information about health, biometric data, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, or trade union membership.

Please do not provide sensitive personal data through the Services unless we specifically request it, or it is strictly necessary in the relevant context.

If this type of information is provided by you, or is otherwise processed in connection with the Services, for example as part of user-generated content, course materials, profile information, or support communications, we will process it in accordance with applicable law and only where we have an appropriate legal basis and, where required, an applicable condition for doing so.

2.12 Aggregated and De-identified Information

We may create aggregated, statistical, anonymised, or de-identified information from personal data so that it no longer identifies, and cannot reasonably be used to identify, an individual. We may use and share this information for lawful business purposes, including analytics, service improvement, research, reporting, and commercial planning.

Where information has been irreversibly anonymised so that it no longer constitutes personal data under applicable law, it is no longer subject to this Privacy Policy.

3. How We Collect Personal Data

We collect personal data in different ways depending on how you interact with the Services, the features you use, and the role or capacity in which you engage with us. The main methods by which we collect personal data are described in the sub-sections below.

3.1 Personal data you provide directly

We collect personal data that you provide directly to us when you:

• create an account or complete a profile;
• purchase a course, subscription, product, or other service;
• apply to become an instructor, creator, contributor, contractor, or employee;
• upload, submit, publish, or send content through the Services;
• take part in community features, communities, reviews, comments, competitions, surveys, promotions, events, or other interactive features;
• contact us for customer support, account assistance, or other enquiries;
• respond to communications from us, including marketing emails, surveys, or feedback requests; or
• otherwise communicate with us online, by email, through forms, or by other means.

This may include information you provide through forms, account settings, onboarding materials, support requests, surveys, applications, messages, or public-facing areas of the Services.

3.2 Personal data collected automatically

When you access or use the Services, we and our service providers may automatically collect certain personal data from your device, browser, or your use of the Services. This may take place through server logs, cookies, pixels, SDKs, local storage, analytics tools, session replay tools, security tools, and similar technologies.

This automatic collection may occur when you browse pages, watch lessons, click links, interact with course content, open emails, use community features, log in across sessions, or otherwise engage with the Services.

3.3 Personal data collected from third parties

We may receive personal data about you from third parties where permitted by law and where relevant to the operation of the Services. These third parties may include:

• payment processors and pay-out providers;
• social login and single sign-on providers;
• analytics, hosting, security, customer support, fraud prevention, communications, and content delivery providers;
• advertising, marketing, and referral partners;
• recruitment agencies, referees, and background check providers;
• business partners, event partners, or service providers involved in a product or service you use; and
• other users, for example where someone refers you, gifts a product to you, invites you to use the Services, or reports content or conduct involving your account.

The personal data we receive from third parties depends on the relevant source, your settings with that third party, and the nature of the relevant service or integration.

3.4 Personal data collected through public and community features

If you use public or community-facing features of the Services, such as profiles, instructor pages, communities, reviews, comments, messaging tools, live events, or competitions, we may collect personal data from those interactions and from the content you choose to make available through them.

Please be aware that information you share through these features may be visible to other users or may be publicly accessible.

3.5 Personal data collected during onboarding, verification, compliance and support

We may collect personal data as part of account verification, instructor onboarding, pay-out setup, fraud prevention, moderation, dispute handling, legal compliance, and customer support processes. This may include information you provide directly, information generated through your use of the Services, and information received from third-party service providers involved in those processes.

In some cases, we may need to collect and verify certain information before we can provide access to particular features or process transactions, for example in order to meet anti-fraud, tax, identity verification, or other legal or compliance requirements.

3.6 Combined data

We may combine personal data collected from different sources, including data you provide directly, data collected automatically, and data received from third parties, where this is reasonably necessary for the purposes described in this Privacy Policy.

For example, we may combine account data, usage data, and third-party data to improve the Services, personalise your experience, support analytics, or help detect fraud and misuse.

4. How We Use Personal Data

We use personal data for the purposes described below, depending on how you interact with the Services, the features you use, and whether you are a visitor, student, instructor, creator, applicant, contractor, or other business contact.

4.1 To provide, operate and administer the Services

We use personal data to provide, operate, and administer the Services, including to:

• create, maintain, and manage user accounts;
• enable access to courses, subscriptions, instructor tools, community features, and other parts of the Services;
• process registrations, purchases, bookings, applications, and other transactions;
• provide course access, track enrolment status, issue completion certificates or badges, and administer learning activity;
• manage instructor onboarding, creator participation, content publication, and related operational processes;
• facilitate interactions between students, instructors, and other users where relevant to the Services; and
• provide core platform functionality, including account authentication, user preferences, and service administration.

4.2 To process payments, pay-outs and financial records

We use personal data to process payments, administer refunds where applicable, manage subscriptions, facilitate instructor or creator pay-outs, maintain transaction records, carry out accounting and audit functions, comply with applicable tax and financial reporting obligations, and otherwise administer the financial aspects of the Services.

4.3 To communicate with you

We use personal data to communicate with you about the Services, including to:

• respond to enquiries, requests, and support issues;
• send service messages, account notifications, technical notices, updates, alerts, and other administrative communications;
• contact you about transactions, applications, onboarding, content moderation, or account-related issues;
• provide information about changes to our terms, policies, or business operations; and
• communicate with instructors, creators, or other payees about matters relevant to their use of the Services.

These communications are necessary for the operation of the Services and are separate from marketing communications.

4.4 To personalise and improve the user experience

We use personal data to personalise your experience and improve the relevance, usability, and presentation of the Services, including to:

• recommend courses, instructors, content, or features that may be relevant to you;
• remember your preferences and settings;
• better understand how users engage with the Services;
• improve navigation, content presentation, and platform functionality;
• tailor aspects of the Services, communications, or user journey based on prior interactions, interests, or platform activity; and
• categorise, organise, or surface content using algorithmic or automated tools to improve discovery, relevance, and usability.

Personalisation may be based on information such as your account data, learning activity, browsing behaviour, preferences, and other interactions with the Services. Where available, you may be able to adjust certain personalisation preferences through your account settings.

4.5 To develop, analyse and improve the Services

We use personal data to analyse, test, troubleshoot, support, and improve the Services, including to:

• monitor performance, diagnose errors, and fix bugs;
• test new tools, features, workflows, or content formats;
• carry out internal analytics, service evaluation, and business reporting;
• understand usage patterns, user demand, and engagement trends;
• support product development, service design, and operational planning; and
• carry out user research, surveys, and feedback exercises to help inform improvements.

4.6 To maintain safety, security and platform integrity

We use personal data to help protect the Services, our users, and our business, including to:

• authenticate users and help prevent unauthorised access;
• detect, investigate, prevent, and respond to fraud, abuse, spam, security incidents, suspicious activity, or other harmful conduct;
• enforce our Terms of Service, Instructor Terms, community standards, and other platform rules;
• moderate content, reviews, comments, communities, and community interactions;
• investigate complaints, disputes, and reports relating to users, content, or conduct;
• manage account restrictions, suspensions, or terminations where necessary; and
• protect the rights, property, safety, and legitimate interests of Wisfy, our users, instructors, staff, partners, and the public.

4.7 To support community, creator and instructor features

We use personal data to operate instructor pages, creator tools, public profiles, communities, reviews, comments, messaging functions, community features, promotions, competitions, workshops, and other collaborative or public-facing areas of the Services.

This may include displaying content and profile information you make available through those features, and providing instructors or creators with relevant information about engagement with their content, as described in Section 6.4.

4.8 To send marketing and promotional communications

We may use personal data to send newsletters, promotional messages, updates about new courses or creators, event invitations, surveys, offers, and other marketing communications, and to measure engagement with those communications, where permitted by applicable law.

We may also use personal data to tailor marketing content based on your interests, learning activity, and interactions with the Services.

You can opt out of marketing communications at any time.

4.9 To comply with legal obligations and protect legal rights

We use personal data where necessary to comply with applicable law, regulation, court order, regulatory request, legal process, or enforcement requirement. This may include compliance with tax, accounting, consumer protection, data protection, and corporate reporting obligations.

We may also use personal data where reasonably necessary to establish, exercise, or defend legal claims, protect our legal rights, or respond to disputes, complaints, investigations, or requests from public authorities.

4.10 To manage business operations and corporate activities

We use personal data for internal business administration and operational purposes, including record-keeping, governance, auditing, compliance monitoring, insurance, financial controls, reporting, service provider management, and business planning.

We may also use personal data in connection with a proposed or actual merger, acquisition, investment, restructuring, financing, sale of assets, or other corporate transaction. In such circumstances, personal data may be disclosed to counterparties, advisers, or other relevant third parties.

4.11 To administer recruitment, applications and business relationships

If you apply to work with us, provide services to us, or otherwise engage with us in a business capacity, we may use personal data to assess applications, communicate with candidates, suppliers, or other business contacts, carry out onboarding, administer contracts, manage the relationship, and maintain related records.

Where applicable, a separate privacy notice may also apply, as described in Section 1.4.

4.12 To create aggregated or de-identified information

We may use personal data to create aggregated, anonymised, or de-identified information that does not identify, and cannot reasonably be used to identify, you. We may use and share this information for analytics, research, service improvement, reporting, commercial planning, and other lawful business purposes.

5. Legal Bases for Processing

We process personal data in accordance with applicable data protection law, including the UK General Data Protection Regulation and the Data Protection Act 2018. The legal basis on which we rely depends on the nature of the personal data, the context in which it is collected, and the purpose for which it is used.

In some cases, more than one legal basis may apply to the same processing activity, depending on the circumstances. The principal legal bases on which we rely are set out below.

5.1 Performance of a contract

We process personal data where it is necessary to enter into or perform a contract with you, including under our Terms of Service and, where applicable, our Instructor Terms.

This includes where processing is necessary to:

• create and manage your account;
• provide access to the Services, including courses, subscriptions, community features, and instructor tools;
• process purchases, bookings, payments, refunds, and related transactions;
• administer instructor or creator onboarding, content publication, and pay-outs;
• provide customer support and respond to service-related requests; and
• communicate with you about your account, purchases, subscriptions, or other essential aspects of the Services.

If you do not provide the personal data needed for these purposes, we may be unable to provide some or all of the Services to you.

5.2 Legitimate interests

We process personal data where it is necessary for our legitimate interests, or those of a third party, provided those interests are not overridden by your interests, fundamental rights, or freedoms.

These legitimate interests may include:

• operating, administering, and improving the Services;
• personalising content, recommendations, and user experience;
• developing new products, tools, features, and business initiatives;
• analysing platform usage, engagement, and performance;
• maintaining platform security, detecting fraud, preventing abuse, and troubleshooting technical issues;
• moderating content and community features, and enforcing our Terms of Service, Instructor Terms, and platform rules;
• managing internal administration, reporting, governance, audits, and business operations;
• communicating with users, instructors, creators, partners, and business contacts on operational matters;
• sending certain direct marketing communications where permitted by applicable law without consent, including where a soft opt-in may apply;
• protecting our business, users, staff, partners, and the public; and
• establishing, exercising, or defending legal claims where appropriate.

Where we rely on legitimate interests, we consider the potential impact on your rights and freedoms and seek to ensure that our interests are not overridden. You may have the right to object to processing carried out on this basis in certain circumstances. If you do so, we will consider your objection in accordance with applicable law.

5.3 Compliance with legal obligations

We process personal data where necessary to comply with a legal or regulatory obligation to which we are subject under applicable UK law or other relevant law.

This may include processing necessary to:

• maintain accounting, tax, financial, and statutory records;
• comply with consumer, tax, corporate, regulatory, and data protection requirements;
• respond to lawful requests from courts, regulators, law enforcement bodies, or other public authorities;
• comply with legal reporting, disclosure, and compliance obligations;
• investigate and address legal or regulatory issues;
• carry out anti-fraud, anti-money laundering, or sanctions screening where required; and
• retain records where retention is required by law or reasonably necessary to demonstrate compliance.

5.4 Consent

We process personal data on the basis of your consent where consent is required by applicable law or where we otherwise choose to rely on consent.

This may include:

• sending certain direct marketing communications where consent is required by law;
• placing or using certain cookies and similar technologies where consent is required;
• processing optional information that you choose to provide for a specific purpose where consent is the appropriate basis; and
• processing special category personal data where your explicit consent is required and no other lawful condition applies.

Where we rely on consent, you may withdraw it at any time by contacting us using the details in Section 17, adjusting your account or cookie settings where available, or using the unsubscribe mechanism in the relevant communication.

Withdrawal of consent will not affect the lawfulness of any processing carried out before that withdrawal, but it may affect our ability to provide certain optional features or services.

5.5 Vital interests

In exceptional circumstances, we may process personal data where necessary to protect your vital interests or those of another person. This basis is likely to apply only in urgent situations involving a risk of serious harm.

5.6 More than one legal basis

We review the legal bases on which we rely and update our practices where necessary to reflect changes in applicable law, regulatory guidance, the Services, or our business operations.

6. When We Share Personal Data

We may share personal data with third parties where reasonably necessary for the purposes described in this Privacy Policy, including to operate the Services, provide requested features, process transactions, support instructors and creators, comply with legal obligations, protect rights and safety, and administer our business.

We do not sell your personal data. We share personal data only in the circumstances described in the sub-sections below.

6.1 Within Wisfy and our corporate group

We may share personal data within Wisfy and with members of our corporate group, affiliates, or related entities where reasonably necessary for internal administration, service delivery, support, security, finance, compliance, reporting, business operations, or the development of the Services.

Where personal data is shared internationally within our corporate group, we apply the safeguards described in Section 11 (International Transfers).

6.2 With service providers and processors

We may share personal data with third-party service providers that perform services on our behalf or support the operation of the Services. Depending on the circumstances, these may include providers of:

• payment processing and pay-out services;
• hosting, cloud storage, infrastructure, and content delivery;
• customer support and communications tools;
• analytics, product performance, and troubleshooting tools;
• security, fraud detection, verification, and abuse-prevention services;
• email delivery, marketing, and campaign management tools;
• session replay and user experience research tools;
• professional advisers, auditors, insurers, and administrative support services; and
• other technical, operational, or business support services.

Where these providers act as data processors, we require them by contract to process personal data only in accordance with our instructions and to maintain appropriate technical and organisational security measures. They are not permitted to use your personal data for their own independent purposes unless they act as independent controllers.

6.3 With payment and financial service providers

If you make a purchase, receive a pay-out, or otherwise engage in a financial transaction through the Services, relevant personal data may be shared with payment processors, banks, pay-out providers, fraud prevention providers, and other financial service providers involved in processing the transaction, preventing fraud, handling chargebacks, carrying out verification, or maintaining related financial records.

6.4 With instructors, creators, students and other users

We may share personal data with other users of the Services where this is necessary for the relevant platform feature or is a natural part of how the Services operate.

For example:

• instructors and creators may receive information relating to enrolments, purchases, student engagement, reviews, or interactions connected with their content, to the extent relevant to operating their offerings. This may include information such as your country, browser language, device settings, and activity on the Services, but we will not share your email address with instructors or creators unless you separately consent or it is required for a specific feature;
• students and other users may see profile information, instructor pages, reviews, ratings, comments, community posts, or other material that a user chooses to publish or make available through the Services; and
• users may receive information where messaging, community, gifting, referral, collaboration, event, or support features involve interaction between accounts.

You should take care when deciding what information to include in public or community-facing areas of the Services.

6.5 With integration partners and third-party tools

Where the Services include or interact with third-party integrations, embedded content, login providers, social media features, video services, event tools, support systems, or similar functionality, relevant personal data may be shared with or made available to those third parties to the extent reasonably necessary for the relevant feature or integration to operate.

Some of these third parties may process personal data as independent controllers under their own privacy notices. We encourage you to review the privacy information of any third-party service you access or interact with through the Services.

6.6 For legal, regulatory and compliance purposes

We may share personal data where we believe this is reasonably necessary or appropriate to:

• comply with applicable law, regulation, legal process, court order, or lawful request from a public authority;
• respond to requests from regulators, law enforcement agencies, tax authorities, courts, or other official bodies;
• enforce our Terms of Service, Instructor Terms, policies, or other legal rights;
• detect, investigate, prevent, or respond to fraud, security incidents, abuse, unlawful activity, or technical issues; or
• protect the rights, property, safety, and legitimate interests of Wisfy, our users, instructors, creators, staff, partners, or the public.

6.7 In connection with disputes, claims and enforcement

We may share personal data with legal advisers, insurers, auditors, expert advisers, debt recovery providers, and other relevant third parties where reasonably necessary in connection with complaints, disputes, investigations, enforcement activity, legal claims, or the establishment, exercise, or defence of legal rights.

6.8 In connection with business transactions

We may share personal data in connection with a proposed or actual merger, acquisition, investment, financing, reorganisation, restructuring, sale of assets, insolvency event, or other corporate transaction. In those circumstances, personal data may be disclosed to counterparties, advisers, financiers, insurers, or other relevant third parties, subject to appropriate confidentiality and legal protections where applicable.

If ownership or control of all or part of the Services changes as a result of such a transaction, we will take reasonable steps to ensure that any successor entity honours the commitments made in this Privacy Policy or notifies you of any material changes before your personal data becomes subject to a materially different privacy framework.

6.9 With your direction or consent

We may share personal data with third parties where you ask us to do so, where this is necessary to provide a feature you choose to use, or where you otherwise direct or expressly consent to the sharing.

6.10 International transfers

Some of the third parties, service providers, affiliates, or partners with whom we share personal data may be located outside the UK. Where we make restricted transfers of personal data outside the UK, we take steps to ensure that appropriate safeguards are in place in accordance with applicable law. For more information, see Section 11 (International Transfers).

7. Public Profiles, Instructor Pages and the Online Community

Certain features of the Services are designed to be social, collaborative, educational, or publicly visible. This section explains how personal data may be displayed, shared, or otherwise made available through public profiles, instructor pages, reviews, comments, communities, and other community features, and what you should consider before using them.

7.1 Public-facing features of the Services

The Services may include public or community-facing features such as user profiles, instructor pages, creator biographies, course pages, reviews, ratings, comments, discussion areas, communities, direct interactions between users, event pages, and other collaborative or interactive features.

If you choose to use these features, certain information about you and content you submit may be visible to other users and, depending on the feature and your settings, may also be publicly accessible on the internet.

7.2 Profile information

Your profile may include information such as your display name, username, profile image, biography, location, creative interests, links, achievements, published courses, reviews, followers, and any other information you choose to add to your profile.

If you are an instructor, creator, or contributor, your instructor or creator page may also include your professional background, promotional descriptions, portfolio information, course listings, ratings, reviews, profile media, and other content associated with your offerings on the Services.

7.3 Reviews, ratings, comments and community posts

If you post a review, rating, comment, community message, discussion response, project update, or similar content through the Services, that content may be visible to other users and may remain associated with your account, display name, profile image, or other profile information.

Please do not post confidential information, financial information, or sensitive personal data in reviews, comments, community posts, or other public or community-facing areas of the Services.

7.4 Public visibility and search engines

Depending on how the Services are configured and how a particular feature is designed, public profiles, instructor pages, course pages, reviews, or community content may be accessible to search engines and other third parties and may appear in search results or be viewed outside the Services.

7.5 User responsibility for public disclosures

You are responsible for the information you choose to submit, publish, display, or otherwise make available through public or community features of the Services. You should think carefully about what you choose to share, particularly where the content may identify you or another person.

If you include personal data relating to another individual in content you post through the Services, you are responsible for ensuring that you have the right to share that information and that doing so complies with applicable law.

7.6 Wisfy moderation and platform controls

We may monitor, moderate, restrict, remove, edit, review, or disable public or community content where this is reasonably necessary to:

• enforce our Terms of Service, Instructor Terms, community standards, or other platform rules;
• protect users, instructors, creators, staff, and the public;
• investigate complaints, reports, abuse, unlawful activity, or suspected misuse of the Services;
• comply with legal or regulatory obligations; or
• maintain the integrity, safety, and quality of the Services.

Moderation may be carried out by human review, automated tools, or a combination of both, where appropriate.

7.7 Changes to profile visibility and content removal

Where account settings or feature design allow, you may be able to update or remove certain profile information or community content through your account settings or by contacting us.

However, you acknowledge that:

• other users may already have seen, copied, shared, cached, archived, screen captured, or otherwise stored content that you made public;
• search engines or other third parties may retain copies of public content; and
• technical or legal limitations may mean that complete removal is not always possible immediately or in every location.

7.8 Instructor and creator visibility

If you are an instructor, creator, or contributor, public visibility is an important part of how your content, profile, and offerings may be presented to students and other users. This may include displaying your name, branding, image, biography, course information, ratings, reviews, and other profile or promotional content in connection with your offerings and with the operation, marketing, and promotion of the Services.

7.9 Interaction between users

Where the Services allow interaction between users, instructors, creators, or community members, personal data may be visible or shared as part of that interaction. This may include messages, comments, mentions, replies, reviews, community activity, event participation, or other interactions that are necessary for, or naturally arise from, the relevant feature.

8. Payments, Fraud Prevention and Third-Party Services

To operate the Services, process transactions, support instructors and creators, protect the platform, and deliver certain features or functionality, we use third-party service providers and may process or share personal data in connection with payments, fraud prevention, verification, security, and related operational services.

8.1 Payment processing

If you purchase a course, subscription, event, digital product, or other offering through the Services, payment-related personal data may be collected and processed by third-party payment processors and financial service providers that support the transaction.

Depending on the payment method and service configuration, this may include information such as your billing name, billing address, email address, payment status, transaction amount, transaction date, order details, and limited payment-related records.

Full payment card details, including the card number, expiry date, and security code, are collected and processed directly by the relevant payment provider. We do not store this information on our own systems.

8.2 Instructor and creator pay-outs

If you are an instructor, creator, contributor, or other payee, we may use third-party pay-out providers, banks, payment intermediaries, or other financial service providers to process amounts due to you.

In connection with this, we may process personal data such as your contact details, pay-out method, bank or payment account details, transaction history, invoicing information, verification information, and related financial records.

Certain pay-out and financial details may be collected and processed directly by the relevant third-party provider, depending on the payment method and service configuration.

8.3 Fraud prevention, verification and account protection

We may use personal data, alone or together with information obtained from service providers, to detect, investigate, prevent, or respond to fraud, suspicious transactions, unauthorised activity, chargebacks, abuse, account compromise, evasion of platform controls, or other harmful or unlawful conduct.

This may include the use of transaction data, device and technical data, account activity, login signals, IP address information, verification checks, payment status indicators, and other relevant risk signals.

8.4 Verification and compliance screening

Where reasonably necessary, we may process personal data to verify identity, assess the legitimacy of transactions, support pay-out administration, comply with financial, tax, anti-fraud, or legal requirements, and maintain appropriate business and compliance records.

This verification may be carried out directly by us or through third-party providers acting on our behalf or in their own capacity, depending on the relevant service.

8.5 Third-party service providers

In addition to the payment, pay-out, and fraud-related providers described above, we use third-party providers to support other operational functions connected with the Services, including hosting, cloud infrastructure, content delivery, customer support, communications, analytics, security, moderation, embedded content, and event administration.

Further information about how we share personal data with service providers and the safeguards we apply is set out in Section 6.2.

8.6 Provider terms and external services

Some third-party providers process personal data under their own privacy notices and terms, particularly where they provide payment services, social login functionality, embedded tools, or other independent integrations. Your use of those services may also be subject to the relevant third party’s terms and privacy practices, and we encourage you to review them where relevant.

8.7 Payment failures, disputes and chargebacks

We may process and share personal data where reasonably necessary to administer failed payments, refunds, cancellations, disputes, chargebacks, account restrictions, fraud investigations, debt recovery, financial reconciliation, and related customer support or compliance matters.

8.8 Security and operational resilience

We may use third-party tools and providers to help secure, maintain, monitor, and improve the reliability of the Services, including tools and services relating to fraud detection, login protection, abuse prevention, incident monitoring, diagnostics, infrastructure resilience, and technical troubleshooting.

8.9 No sale of personal data

We do not sell your personal data. However, we may disclose personal data to third-party providers and partners where necessary to operate the Services, process payments and pay-outs, prevent fraud, deliver platform features, comply with legal obligations, or otherwise as described in this Privacy Policy.

9. Cookies and Similar Technologies

We and our third-party providers may use cookies and similar technologies on the Services for operational, security, performance, analytics, personalisation, and, where applicable, marketing purposes.

Cookies and similar technologies may include browser cookies, pixels, tags, web beacons, software development kits (SDKs), local storage, session identifiers, and other technologies that store information on, or access information from, your device or browser.

Where required by applicable law, including the Privacy and Electronic Communications Regulations 2003 (PECR), we will seek your consent before using cookies or similar technologies that are not strictly necessary for the operation of the Services.

9.1 What are cookies and similar technologies?

Cookies are small text files placed on your device or browser when you visit a website. Similar technologies can perform comparable functions, such as recognising a device or browser, remembering preferences, measuring activity, enabling integrations, or helping us understand how the Services are used.

9.2 Why we use them

We may use cookies and similar technologies to:

• enable core platform functionality and security;
• keep you signed in and maintain session integrity;
• remember your settings and preferences;
• measure traffic, usage, and performance;
• understand how users interact with the Services;
• improve content, navigation, and user experience;
• support embedded media, integrations, and interactive tools;
• personalise certain content or features; and
• where applicable, support marketing, measurement, and advertising activities.

9.3 Categories of cookies and similar technologies

We may use the following categories of cookies and similar technologies:

(a) Strictly necessary technologies

These are necessary for the Services to operate properly and securely. They may be used for functions such as authentication, security, fraud prevention, load balancing, session management, shopping basket functionality, account access, and remembering privacy preferences. Because these technologies are necessary for the operation of the Services, they may be used without consent where permitted by law.

(b) Functional or preference technologies

These help remember your choices and improve convenience, such as language settings, region, display preferences, login state, or other personalisation settings.

(c) Analytics and performance technologies

These help us understand how the Services are used, measure performance, identify errors, improve functionality, and analyse engagement trends. They may collect information such as pages visited, time spent on pages, device and browser details, navigation patterns, and interaction events. This category may include session replay technologies, as described in Section 2.6.

(d) Personalisation technologies

These may be used to tailor content, recommendations, interfaces, or user journeys based on your interactions with the Services.

(e) Advertising, campaign, and measurement technologies

Where used, these may help us and our partners measure the effectiveness of campaigns, understand engagement with promotions, limit repeated advertising, or deliver more relevant marketing content. Where required by applicable law, these technologies will only be used with your consent.

9.4 First-party and third-party technologies

Some cookies and similar technologies are set by Wisfy. Others may be set by third parties whose services we use, such as analytics providers (Google Analytics), payment providers, embedded content providers, customer support tools, social login providers, security vendors, event or marketing tools, or other service providers involved in operating the Services.

Third-party providers may have their own privacy notices, as described in Section 1.6.

9.5 Consent and your choices

Where legally required, we will seek your consent before placing or using non-essential cookies and similar technologies. You can manage your preferences through our cookie banner, consent management tool, or any other settings made available to you.

You can also control cookies through your browser or device settings. For more information about managing cookies in your browser, please refer to your browser’s help or settings pages.

However, blocking or disabling certain technologies may affect the availability, performance, or functionality of parts of the Services. Strictly necessary technologies cannot be disabled through our consent tools because they are required for the Services to function.

9.6 Changes to cookies and similar technologies

The specific cookies and similar technologies used through the Services may change over time as the Services develop and as we add, remove, or change providers, integrations, or features. We may update our cookie tools, settings, or notices from time to time to reflect those changes.

10. Marketing Communications and Your Choices

We may use personal data to send you marketing and promotional communications about Wisfy, the Services, courses, instructors, creators, events, offers, updates, surveys, competitions, partnerships, and other products or services that may be of interest to you, where permitted by applicable law.

10.1 Types of communications

Marketing and promotional communications we send may include:

• newsletters and editorial updates;
• announcements about new courses, instructors, creators, features, or events;
• offers, promotions, discounts, competitions, and campaigns;
• recommendations and personalised marketing based on your interactions with the Services; and
• invitations to take part in surveys, feedback exercises, or promotional initiatives.

10.2 Service communications are different from marketing

Some communications are necessary for the operation of the Services and are not marketing communications. These may include account confirmations, purchase receipts, course enrolment messages, security alerts, payment or pay-out notices, policy updates, support responses, moderation notices, and other administrative or service-related messages.

You may continue to receive these service communications even if you opt out of marketing communications.

10.3 How we may contact you

Where permitted by applicable law, we may send marketing communications by email, in-platform messages, push notifications, SMS, or other electronic communications, and, where appropriate, through other channels connected with your account or your interaction with the Services.

10.4 Legal basis for marketing

We may send marketing communications where:

• you have given your consent;
• the law allows us to rely on an existing customer relationship or a similar exemption, such as the soft opt-in under the Privacy and Electronic Communications Regulations 2003 (PECR); or
• another lawful basis is available under applicable data protection law for the relevant communication and channel.

Where consent is required by law, we will seek it before sending the relevant marketing communications.

10.5 Your choices and opt-out rights

You can opt out of marketing communications at any time by:

• clicking the unsubscribe link in a marketing email;
• adjusting your communication or account preferences where those settings are available;
• using your device or app settings for push notifications, where relevant; or
• contacting us using the details set out in this Privacy Policy.

If you object to our use of your personal data for direct marketing, we will stop processing your personal data for that purpose.

10.6 Preference updates and suppression

Please note that it may take a reasonable period for your preferences to be updated across all relevant systems. We may retain limited information about your opt-out request so that we can honour your preferences and help ensure that you do not receive further marketing communications from us.

10.7 Personalised marketing and measurement

Where permitted by applicable law, we may use personal data such as your account information, interests, course activity, browsing behaviour, purchase history, and engagement with the Services or our communications to tailor marketing content, recommendations, and campaigns so that they are more relevant to you, and to measure their effectiveness.

Where available, you may be able to adjust certain personalisation preferences through your account settings or cookie settings.

10.8 Third-party marketing and co-promotions

We may use service providers or marketing platforms to help deliver and measure marketing communications on our behalf. Where those providers act as processors, they are required to process personal data only in accordance with our instructions and are not permitted to use it for their own independent marketing purposes.

We may also run co-branded campaigns, partnerships, or promotional activity with third parties from time to time. Where this involves sharing your personal data with a third party for its own marketing purposes, we will seek your consent before doing so unless another lawful basis applies.

Where appropriate, we will make clear who is sending the communication, how your personal data is being used, and what choices you have.

10.9 Marketing to instructors, creators, applicants and business contacts

We may also send relevant business-related or promotional communications to instructors, creators, applicants, suppliers, and other business contacts regarding opportunities, platform developments, onboarding, partnerships, services, events, or related matters, where permitted by applicable law.

The opt-out rights described in Section 10.5 apply equally to these communications where they constitute direct marketing.

10.10 Changes to your choices

You can change your marketing preferences at any time using the methods described in Section 10.5. However, opting out of one type of marketing communication or one channel does not automatically opt you out of all other marketing communications or channels unless stated otherwise.

If you want to stop receiving marketing communications across all channels, please use the relevant unsubscribe mechanism for each channel or contact us using the details in Section 17, and we will update your preferences accordingly.

11. International Transfers

Wisfy is based in the United Kingdom, but we may use service providers, affiliates, partners, or other recipients located outside the UK. As a result, your personal data may in some circumstances be transferred to, stored in, or accessed from locations outside the UK.

Where we make a restricted transfer of personal data outside the UK, we take steps to ensure that the transfer is made in accordance with applicable data protection law, including the UK GDPR and the Data Protection Act 2018, and that an appropriate level of protection is applied to your personal data.

11.1 When international transfers may occur

International transfers may occur where personal data is processed by, or made accessible to:

• hosting, cloud infrastructure, and content delivery providers;
• payment processors, pay-out providers, banks, and fraud prevention providers;
• analytics, communications, customer support, security, verification, and operational service providers;
• marketing, advertising, and campaign management providers;
• affiliates, advisers, counterparties, or service providers involved in a corporate transaction; or
• other third parties described elsewhere in this Privacy Policy.

Because some of these providers operate internationally, personal data may be transferred to, stored in, or accessed from countries outside the UK. This may include, in particular, the United States, countries within the European Economic Area, and other jurisdictions in which our providers or their sub-processors operate.

Not every category listed above will necessarily involve an international transfer, as this depends on where the relevant provider is located and how the relevant service is configured.

11.2 Safeguards we may rely on

Where required, we rely on one or more lawful transfer mechanisms and safeguards, including:

• UK adequacy regulations, where the destination country, territory, or sector has been recognised by the UK Secretary of State as providing an adequate level of protection;
• the UK International Data Transfer Agreement (IDTA);
• the UK Addendum to the EU Standard Contractual Clauses;

Binding Corporate Rules, where applicable; or

• another lawful transfer mechanism or derogation recognised under applicable data protection law.

Where we rely on the IDTA or the UK Addendum to the EU Standard Contractual Clauses, we may also carry out a transfer risk assessment where appropriate to assess the level of protection available in the destination country.

11.3 Additional protective measures

Where appropriate, we may also apply supplementary technical, organisational, or contractual measures designed to help protect personal data transferred internationally. Depending on the circumstances, these may include access controls, data minimisation, contractual restrictions, security measures, transfer risk assessments, and other safeguards that are reasonable for the relevant transfer.

11.4 Your rights and further information

You may request further information about the safeguards we rely on for restricted transfers of your personal data, subject to applicable confidentiality, legal, and commercial limitations.

Further information about your general privacy rights, including your rights of access, objection, and complaint, is set out in Sections 14 and 18 of this Privacy Policy.

11.5 Changes to international processing locations

The countries in which personal data is processed may change from time to time as our Services, provider arrangements, business operations, and technical infrastructure develop. We may update this Privacy Policy to reflect any material changes where appropriate.

12. Data Retention

We retain personal data for as long as is reasonably necessary for the purposes described in this Privacy Policy, including to provide the Services, maintain accounts, deliver purchased content, administer instructor and creator relationships, comply with legal, tax, accounting, and regulatory obligations, resolve disputes, prevent fraud and abuse, enforce our terms, and protect our business and users.

We do not retain personal data in identifiable form for longer than is reasonably necessary. Where personal data is no longer required for the purposes described in this Privacy Policy, we will delete it, anonymise it, or de-identify it in accordance with applicable law.

12.1 How we determine retention periods

The length of time for which we retain personal data depends on factors such as:

• the type of personal data involved;
• the purpose for which it was collected and is used;
• whether the data is needed to provide ongoing access to the Services or to maintain an account;
• whether we are under a legal, regulatory, tax, accounting, or reporting obligation to keep it;
• whether retention is reasonably necessary for security, fraud prevention, dispute resolution, enforcement, or the establishment, exercise, or defence of legal claims; and
• whether the data can be deleted, anonymised, or de-identified without affecting legitimate business or legal needs.

12.2 Account and service records

We may retain account data, profile information, course enrolment records, transaction-linked service records, customer support history, and related platform data for as long as your account remains active and for a reasonable period afterwards.

Where accounts become inactive, we may retain related information for a period we consider reasonably necessary for account reactivation, service continuity, fraud prevention, record-keeping, dispute handling, or compliance. Where an account has been inactive for two (2) years, we may notify you before deleting, anonymising, or de-identifying the associated personal data, unless retention is required for another purpose described in this Section 12. We may also delete, anonymise, or de-identify inactive account data in accordance with our internal retention practices.

If you request deletion of your account, we will handle that request in accordance with Section 14, subject to any overriding retention obligations described in this Section 12.

12.3 Purchases, payments and financial records

We may retain purchase records, billing records, pay-out records, invoices, transaction history, refund records, and related financial documentation for as long as reasonably necessary to comply with applicable accounting, tax, audit, and financial reporting obligations.

Under applicable law, including HMRC requirements, financial, accounting, tax, VAT, and transaction records may need to be retained for a minimum of six (6) years from the end of the relevant accounting period or financial year. In some circumstances, longer retention periods may apply, including where records relate to cross-border tax or reporting obligations, ongoing compliance checks, audits, disputes, or other legal or regulatory requirements.

12.4 Security, fraud, abuse and legal matters

We may retain personal data for longer than would otherwise be necessary where reasonably required in connection with fraud prevention, security monitoring, abuse detection, moderation, chargebacks, investigations, complaints, disputes, legal proceedings, or the enforcement of our rights and obligations.

Data related to fraud detection, security incidents, abuse prevention, or related investigations may be retained for up to six (6) years where reasonably necessary, including by reference to applicable limitation periods under the Limitation Act 1980 and the need to establish, exercise, or defend legal claims. Different retention periods may apply depending on the nature of the issue and the legal rights involved.

12.5 Marketing and preference records

If you opt into marketing communications, your contact details and consent records will be retained until you withdraw consent. Suppression records and opt-out preferences may be retained after withdrawal for as long as reasonably necessary to ensure that we respect your preferences and do not send further marketing communications. Consent records may also be retained for a reasonable period to demonstrate compliance with applicable law.

12.6 Community content and public content

If you post reviews, comments, community content, community material, or other user-generated content through the Services, we may retain that content for as long as reasonably necessary for the operation of the relevant feature, community integrity, moderation, dispute handling, enforcement, and record-keeping.

Where accounts are deleted or content is removed, some associated material may be deleted, de-linked, anonymised, or retained where reasonably necessary for legal, security, compliance, backup, or technical reasons. Please also note that content you have made public may already have been seen, copied, cached, or otherwise stored by other users or third parties.

12.7 Backups, archives and residual copies

Deleted personal data may remain in backups, archives, logs, disaster recovery systems, or residual technical environments for up to ninety (90) days before being overwritten or securely deleted in the ordinary course, where this is reasonably necessary for resilience, business continuity, security, or operational integrity.

12.8 Anonymised and aggregated information

Where personal data has been irreversibly anonymised so that it no longer identifies, and cannot reasonably be used to identify, you, we may retain and use that information indefinitely for analytics, research, reporting, service improvement, commercial planning, and other lawful business purposes. As explained in Section 2.12, such information is no longer subject to this Privacy Policy.

12.9 Deletion requests and legal exceptions

You may have the right to request deletion of your personal data in certain circumstances. However, that right is not absolute, and we may retain personal data where necessary to comply with legal obligations, maintain financial or tax records, protect against fraud or abuse, resolve disputes, enforce our agreements, or establish, exercise, or defend legal claims.

Further information about your rights is set out in Section 14 (Your Rights and Choices).

13. Data Security

We take the security of personal data seriously and implement appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, unauthorised access, misuse, and other unlawful processing.

These measures are selected, implemented, and maintained having regard to the nature of the personal data involved, the risks presented by the processing, the state of the art, the cost of implementation, and the requirements of applicable law, including the UK GDPR and the Data Protection Act 2018.

13.1 Security measures

Depending on the nature of the Services and the risks involved, our security measures may include:

• access controls and role-based restrictions designed to limit access to personal data to authorised personnel who need it for legitimate business purposes;
• technical safeguards, including encryption of data in transit using SSL/TLS and, where appropriate, encryption of data at rest;
• authentication, account protection, and session security measures;
• monitoring, logging, alerting, and other measures designed to detect suspicious activity, misuse, or security events;
• processes for patching, maintenance, testing, and improving the security of our systems and services;
• vendor and service provider due diligence, together with security review processes where appropriate; and
• internal policies, training, and administrative controls relating to the handling of personal data.
• anonymisation and pseudonymisation of personal data, where feasible and appropriate to the nature of the processing, to reduce risk in the event of unauthorised access or a security incident.

13.2 No absolute guarantee

Although we take reasonable steps to protect personal data, no method of transmission over the internet, electronic storage system, or security control is completely secure. Accordingly, we cannot guarantee absolute security.

If you believe that your account, or any personal data you have provided to us, may have been compromised, please contact us immediately using the details in Section 17.

13.3 Security incidents and breach response

We maintain processes designed to identify, investigate, contain, assess, and respond to suspected or actual security incidents involving personal data. Where required by applicable law, we will notify the relevant supervisory authority and, where appropriate, affected individuals.

Under the UK GDPR, a notifiable personal data breach must be reported to the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it. Where a breach is likely to result in a high risk to the rights and freedoms of affected individuals, we will also notify those individuals without undue delay.

13.4 Your role in protecting your information

You also play an important role in helping to protect your personal data. You should:

• use a strong and unique password for your account;
• keep your login credentials confidential;
• avoid sharing your account with others unless expressly permitted by our terms;
• take care when using public or shared devices;
• be cautious of phishing attempts, impersonation, and suspicious communications; and
• notify us promptly if you believe your account or personal data may have been compromised.

13.5 Third-party providers

Where we engage third-party providers to support the operation of the Services, we take steps to select providers that maintain appropriate security measures and to put suitable contractual protections in place, as described in Section 6.2. However, third-party services operate under their own systems and controls, and we cannot guarantee the security practices of those third parties.

13.6 Security-related retention and records

We may retain security-related records, logs, alerts, audit trails, and incident documentation for up to six (6) years. These records are accessible only to authorised personnel and are used solely for security monitoring, investigation, compliance, and the establishment, exercise, or defence of legal claims. Logs containing personal data are retained in compliance with applicable data protection law and securely deleted after the retention period.

13.7 Force Majeure and Events Beyond Our Control

Although we implement appropriate technical and organisational security measures, events beyond our reasonable control may affect the security, availability, or integrity of the Services and the personal data processed through them. These events may include, for example:

• cyberattacks, hacking, ransomware, denial-of-service attacks, or other malicious interference, despite appropriate safeguards;
• natural disasters, fires, floods, severe weather events, or other acts of God;
• power outages, telecommunications failures, internet disruptions, or hosting infrastructure failures beyond our reasonable control;
• government actions, sanctions, regulatory changes, or compliance requirements imposed without reasonable notice; and
• pandemics, epidemics, or public health emergencies affecting our operations or those of our service providers.

In such circumstances, we will take reasonable steps to contain and mitigate the impact, including engaging technical or cybersecurity support where appropriate, implementing incident response measures, and notifying affected individuals and the Information Commissioner’s Office where required by applicable law.

Nothing in this section excludes or limits any obligation to report a personal data breach to the ICO or to notify affected individuals where required under the UK GDPR.

14. Your Rights and Choices

Subject to applicable law, including the UK GDPR and the Data Protection Act 2018, you may have certain rights in relation to the personal data we hold about you. These rights are not absolute and may be subject to conditions, limitations, exemptions, or overriding legal requirements.

The principal rights available to you are set out in the sub-sections below.

14.1 Your rights

Depending on the circumstances, you may have the right to:

(a) Access

Request confirmation of whether we process your personal data and, where we do, request access to that personal data and related information about how it is used.

(b) Rectification

Request that we correct inaccurate personal data or complete incomplete personal data.

(c) Erasure

Request that we delete your personal data in certain circumstances, sometimes referred to as the “right to be forgotten”.

(d) Restriction

Request that we restrict the processing of your personal data in certain circumstances, for example while a concern about accuracy or lawfulness is being considered.

(e) Portability

Request to receive certain personal data you have provided to us in a structured, commonly used, and machine-readable format, and in some cases request that we transmit it to another controller where technically feasible.

(f) Objection

Object to processing based on legitimate interests or certain other lawful bases in circumstances provided by law.

You also have the absolute right to object to the processing of your personal data for direct marketing purposes. If you object to direct marketing, we will stop processing your personal data for that purpose.

(g) Withdraw consent

Where we rely on your consent, you may withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing carried out before that withdrawal.

(h) Rights in relation to automated decision-making

Where we make decisions based solely on automated processing, including profiling, that produce legal effects or similarly significant effects concerning you, you may have the right not to be subject to those decisions unless an exception applies under applicable law.

Where we use automated tools to support content recommendations, personalisation, fraud prevention, moderation support, or other platform features, those tools will not generally be used to make decisions that produce legal or similarly significant effects concerning you without appropriate safeguards where required.

14.2 How to exercise your rights

You may exercise your rights by contacting us using the details set out in Section 17. We may need to request information to verify your identity before responding, particularly where your request relates to access, deletion, portability, or other actions affecting your personal data.

We will respond to valid requests without undue delay and, in any event, within one month of receipt, unless a longer period is permitted under applicable law. If we need to extend this period, we will inform you of the reason for the delay within the original one-month period.

14.3 Limits and exceptions

Your rights may be limited in certain circumstances. For example, we may be unable to fulfil all or part of a request where:

• we are required to retain data to comply with legal, tax, accounting, regulatory, or record-keeping obligations;
• the data is needed for fraud prevention, security, moderation, dispute handling, or the establishment, exercise, or defence of legal claims;
• fulfilling the request would adversely affect the rights and freedoms of another person; or
• the request is manifestly unfounded, excessive, or otherwise falls within a lawful exemption.

Where we are unable to fulfil a request, in whole or in part, we will explain the reasons, subject to any legal restrictions, and where applicable we will also inform you of your right to lodge a complaint with the ICO or seek a judicial remedy.

14.4 Account settings and practical controls

In some cases, you may be able to review, update, correct, delete, or otherwise manage aspects of your personal data directly through your account settings, profile settings, communication preferences, cookie controls, or other tools made available through the Services.

14.5 Marketing and cookies choices

You have choices about marketing communications and the use of non-essential cookies and similar technologies. For full details on how to manage these preferences, see Section 9 (Cookies and Similar Technologies) and Section 10 (Marketing Communications and Your Choices).

14.6 Complaints

If you wish to make a complaint about how we handle your personal data, please see Section 18 (Complaints).

15. Online Community

Wisfy.com may provide an online community and related community features through which users can participate in discussions, share ideas, ask questions, and engage with other members of the community. This section explains how personal data may be collected, displayed, shared, and used in connection with the community, and what you should be aware of before choosing to participate.

15.1 Data Collection in the Community

When you use the community, we may collect and process personal data relating to your participation, including:

• your username, display name, profile image, and other profile information visible in the community;
• posts, comments, replies, messages, and other content you submit;
• interaction data such as likes, follows, mentions, bookmarks, and timestamps; and
• device, technical, and log data, such as IP address and browser information, for security, moderation, and platform integrity purposes.

This data is collected and processed in accordance with the categories and purposes described in Sections 2, 4, and 7 of this Privacy Policy.

15.2 How We Use Your Community Data

We use personal data collected through the community for the purposes described in Section 4, including to:

• facilitate discussions, interactions, and community engagement;
• moderate content and enforce our Terms of Service, community standards, and community rules;
• improve the functionality, usability, and security of the community; and
• detect, investigate, and prevent fraud, abuse, spam, or other harmful or unlawful conduct.

15.3 Publicly Available Information

Content you post in the community, including posts, comments, replies, and associated profile information, may be visible to other users and may be publicly accessible on the internet.

Please do not share sensitive personal data, confidential information, financial information, or personal data about other individuals in community posts or comments unless you are entitled to do so. Once content has been posted, it may be seen, copied, cached, or otherwise stored by other users or third parties before you have the opportunity to edit or remove it.

We may moderate community content as described in Section 7.6, but we are not responsible for how other users or third parties use information that you choose to make publicly available. For more information about public visibility and your responsibilities, see Section 7.

15.4 Data Retention and Removal

Community posts, comments, and related interaction data may be retained for as long as reasonably necessary for the purposes described in this Privacy Policy, including community integrity, moderation, dispute handling, and record-keeping.

If you delete a post or request its removal, we will take reasonable steps to remove it from public view where applicable. However, deleted content may remain in backups or residual systems for a limited period, as described in Section 12.7, and may already have been seen, copied, or cached by other users or third parties.

If your account is deleted or terminated, your community content may be anonymised, de-linked from your profile, or retained where reasonably necessary for the purposes described in Section 12. If you would like your community content to be deleted rather than anonymised, please contact us using the details in Section 17.

15.5 Community Moderation and Enforcement

We may monitor, moderate, restrict, remove, or disable community content, and may suspend or restrict community access for users who breach our Terms of Service, community standards, or community rules. Moderation may be carried out by human review, automated tools, or a combination of both.

Further information about our moderation powers and the grounds on which we may act is set out in Section 7.6. If you have concerns about community content, or wish to request the removal of specific content, please contact us using the details in Section 17.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in the Services, our business operations, platform features, legal or regulatory requirements, data processing practices, security measures, or other relevant developments. When we do so, we will update the “Last updated” date at the top of this Privacy Policy.

16.1 Updates to this Privacy Policy

When we update this Privacy Policy, we will revise the “Last updated” date at the top of the policy. Unless otherwise stated, the updated version will take effect from that date.

16.2 Material changes

If we make changes that materially affect how we collect, use, share, or otherwise process personal data, we will provide additional notice by appropriate means. Depending on the circumstances, this may include:

• posting a prominent notice on the Services;
• displaying an in-product or account notice;
• contacting you by email or another relevant communication channel; or
• using another method reasonably designed to bring the changes to your attention.

Where a material change requires your consent, or affects processing that is based on your consent, we will seek fresh consent where required by applicable law.

16.3 New purposes or legally significant changes

If we intend to use personal data for a new purpose that is materially different from the purposes described in this Privacy Policy, we will update this Privacy Policy and, where required by applicable law, bring that change to your attention before starting the new processing.

Where applicable law requires us to obtain your consent for a new purpose or a material change in processing, we will seek that consent before the new processing begins.

16.4 Your responsibility to review this Privacy Policy

You should review this Privacy Policy from time to time so that you remain informed about how we process personal data and about any changes to our practices. If you do not agree with an updated Privacy Policy, you should stop using the Services and, where relevant, may contact us about your rights and choices under this Privacy Policy.

16.5 Related notices

Where we provide supplementary or just-in-time privacy notices for specific activities, features, products, campaigns, events, or jurisdictions, those notices may also be updated from time to time. They should be read together with this Privacy Policy, as described in Section 1.4.

17. Contact Details

If you have any questions, concerns, or requests about this Privacy Policy, your personal data, or how we process personal data, you may contact us using the details below.

17.1 Data controller

Wisfy Ltd

No 1 The Spinney, 121 Main Road

Danbury, Essex

CM3 4DL

United Kingdom

Email: support@wisfy.com

17.2 Privacy enquiries and rights requests

You may contact us using the details above if you wish to:

• ask a question about this Privacy Policy;
• exercise your rights in relation to your personal data;
• update or correct your information;
• raise a concern about how we handle personal data; or
• make a complaint directly to us.

We may ask for information reasonably necessary to verify your identity before responding to certain requests.

17.3 Complaints

If you have a concern about how we handle your personal data, we would appreciate the opportunity to address it first. However, you also have the right to lodge a complaint with the Information Commissioner’s Office (“ICO”), the UK supervisory authority for data protection matters.

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

United Kingdom

Telephone: 0303 123 1113

The ICO’s published contact details currently list Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF and telephone 0303 123 1113.

17.4 Accessibility and additional notices

If you require this Privacy Policy in another format, or if you need assistance understanding any part of it, please contact us using the details above.

18. Complaints

We take concerns about privacy and personal data seriously and aim to deal with complaints fairly, promptly, and responsibly.

18.1 Raising a complaint with us

If you have a complaint about how we collect, use, share, retain, protect, or otherwise process your personal data, you may contact us using the details set out in Section 17 (Contact Details).

When contacting us, it is helpful if you provide enough information for us to understand and investigate the issue, including your name, contact details, a description of your concern, and any relevant supporting information.

18.2 How we handle complaints

We will acknowledge receipt of your complaint within five (5) business days and aim to provide a substantive response within one (1) month, unless the complaint is complex and requires further investigation. Where a complaint also involves the exercise of a legal data protection right, we will deal with that aspect in accordance with the applicable statutory timeframe described in Section 14.2.

We may need to request additional information, including information needed to verify your identity, before we can investigate or respond fully. We will keep you appropriately informed of the progress and outcome of your complaint.

18.3 Complaining to the ICO

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection matters, if you believe that your personal data has been handled in a way that does not comply with applicable data protection law.

The ICO can be contacted at:

Website: ico.org.uk

Helpline: 0303 123 1113

Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Although we would appreciate the opportunity to address your concerns first, you are not required to contact us before approaching the ICO.

18.4 Other rights and remedies

Nothing in this Privacy Policy prevents you from exercising any rights or remedies available to you under applicable data protection law.

19. Definitions

In this Privacy Policy, the following terms have the meanings set out below.

Consent

A freely given, specific, informed, and unambiguous indication of your wishes by which you agree to the processing of your personal data for a particular purpose through a clear affirmative act.

Controller

The person or organisation that determines the purposes and means of processing personal data. For the purposes of this Privacy Policy, the controller is Wisfy Ltd, except where this Privacy Policy or a separate notice states otherwise.

Cookies and Similar Technologies

Cookies and other technologies that store information on, or access information from, your device or browser, including pixels, tags, web beacons, SDKs, local storage, and similar technologies used for functionality, analytics, security, personalisation, or marketing.

Data Protection Act 2018 (DPA 2018)

The UK Data Protection Act 2018, which supplements and sits alongside the UK GDPR.

Data Protection Impact Assessment (DPIA)

A risk assessment carried out where required by applicable law before certain higher-risk processing of personal data takes place.

Data Protection Officer (DPO)

An individual formally appointed where required by applicable law to advise on and monitor compliance with data protection obligations.

ICO

The Information Commissioner’s Office, the UK’s independent supervisory authority for data protection matters.

Instructor / Creator / Contributor

An individual who offers, publishes, or contributes content, courses, or other materials through the Services.

Personal Data

Any information relating to an identified or identifiable natural person.

PECR

The Privacy and Electronic Communications Regulations 2003, which govern cookies, electronic marketing, and related privacy rules in the UK.

Processing / Process / Processed

Anything done with personal data, including collecting, recording, organising, storing, using, disclosing, transferring, combining, restricting, deleting, or otherwise handling it.

Processor

A person or organisation that processes personal data on behalf of, and under the instructions of, a controller.

Public Profile

A user, instructor, or creator profile, page, or account area that may be visible to other users or, depending on the feature and configuration, publicly accessible on the internet.

Recipient

Any person or organisation to whom personal data is disclosed, including service providers, payment providers, professional advisers, public authorities, or other third parties where disclosure is permitted or required.

Restricted Transfer

A transfer of personal data from the UK to a country or territory outside the UK that is not covered by a UK adequacy regulation.

Services

The websites, applications, APIs, community features, instructor tools, events, content, products, and related services made available by Wisfy and covered by this Privacy Policy, as further described in Section 1.2.

Special Category Personal Data

Personal data that is subject to additional protection under applicable law, including data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for identification, health data, or data concerning a person’s sex life or sexual orientation.

UK GDPR

The United Kingdom General Data Protection Regulation, as it forms part of UK law and is amended from time to time.

Usage Data

Information about how you interact with the Services, such as pages viewed, features used, searches performed, course activity, engagement data, and similar usage information.

User-Generated Content

Content that you create, upload, submit, post, publish, or otherwise make available through the Services, such as reviews, comments, community posts, assignments, images, videos, or messages.

You / Your

The individual who accesses, uses, interacts with, or otherwise engages with the Services.