Privacy policy

​​Last reviewed: 07/12/2025

​

Being an online training platform, data protection and online safety are core to how we operate. This Privacy Policy explains what personal data The Surveying Academy (“we”, “us”, “our”) collects, how and why we use it, and your rights. We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018) and are registered with the ICO.

​

Questions: please contact info@thesurveyingacademy.co.uk or write to 10a High Street, Chislehurst, England, BR7 5AN.
 

1. Product data collection and use

​

When you purchase or access our eLearning Courses (including modules, assessments and quizzes), you and/or your organisation agree to our Terms & Conditions. If you provide us with your employees’ details to create learner accounts, you confirm you have a lawful basis to do so and have provided any required privacy information to those individuals.

​

Accounts & access
Course access is via user accounts protected by passwords. We recommend you choose strong, unique passwords and sign out after use. We will never ask for your password in an unsolicited call or email.

​

What we collect and store securely

• Name, business email, job title, company name, team/role, billing/contact details

• Communications with us, support tickets, training preferences

• Purchase history and payment status (card details are handled by our payment provider; we do not store them)

• Course enrolments, module progress, quiz attempts and results (incl. 100% pass-rate completions)

• Activity logs related to learning (e.g., last login, completions)

​

We use this data to operate the platform, provide support, monitor progress, and help organisations evidence training and competence.

​

We may aggregate/anonymise learning outcomes and usage statistics for internal analytics, product improvement, and marketing (never in a way that identifies an individual).

​

2. Updating your information

​

You (or your organisation’s admin) can request updates or corrections by emailing info@thesurveyingacademy.co.uk . We may need to verify your identity before making changes.

​

3. How we use your personal information

​

• Provide and administer accounts, Course access and record progress/results

• Send service communications (onboarding, updates, maintenance)

• Provide support and troubleshoot issues

• Billing and account management

• Product updates relevant to your use

• Support and troubleshooting

• Improve content and user experience 

• We do not sell personal data.

​

3A. Legal bases for processing and marketing use of data

​

We rely on:

• Contract – to deliver the Courses and services you (or your organisation) purchase.

• Legitimate interests – to run, secure, and improve the platform; B2B marketing to relevant professional contacts; product analytics and personalisation proportionate to your expectations.

• Legal obligation – e.g., tax/financial recordkeeping.

• Consent – where required (e.g., certain cookies, sharing your professional experience in case studies).

• We assess legitimate interests by identifying our interest, checking necessity, and balancing against your rights.

​

3B. Marketing and analytics

​

We may use your data to:

• Tell you about services we believe will be relevant (unless you opt out);

• Improve and personalise your experience using analytics;

• Invite you to surveys, research, or case studies (always voluntary);

• Offer free trials, demos, or previews of new content;

• Contact you about related courses

• Run competitions or promotions.

• Contact you through in-product messages, live chat, telephone, SMS, email, post, or social media.

• Show you relevant advertising on trusted third-party platforms (e.g. LinkedIn, Google, Facebook, Instagram). This is done by creating anonymised, targeted audiences. You can opt out via those platforms’ settings or by contacting us directly.

​

Analytics:
We use analytics providers (e.g., Google Analytics, learning platform analytics) to understand usage and improve content. Data is aggregated/anonymised where possible.

​

Your choices:

• Click unsubscribe in any marketing email, or

• Email info@thesurveyingacademy.co.uk  to opt out.

• Service and security notices are not optional.

​

4. Our role as a data controller and a processor

​

We act as:

Data Controller for our website, marketing, billing, account administration, and when we determine the purposes and means of processing learner data on the platform.

​

Data Processor where we process learner data strictly on your organisation’s documented instructions (for example, if we host/company-administer accounts and only act under your direction).

​

Where we act as Processor, a data processing agreement (DPA) will apply; please contact us if you require one. Your organisation remains responsible for providing appropriate privacy information to its employees.

​

5. Subject Access Requests (your rights)

​

You have rights under UK GDPR, including: access, rectification, erasure, restriction, portability, and objection (including to marketing based on legitimate interests).

Email info@thesurveyingacademy.co.uk  with details of your request. If you submit electronically, we’ll respond electronically. We will respond within one month where possible.

​

If you’re not satisfied, you can complain to the Information Commissioner’s Office (ICO):
ico.org.uk | 0303 123 1113.

​

6. How long we keep data

​

We keep personal data only as long as necessary:

• Accounts and learning records: retained while your organisation’s subscription is active. After termination, we typically retain learner progress records for up to 24 months to support audit queries, unless the Controller requests earlier deletion or law requires longer.

• Product analytics (aggregated/anonymised): retained without identifying individuals.

• Marketing contacts: retained while the relationship is active or until you opt out; we keep suppression list entries to honour future opt-outs.

• Financial records: retained 6 years (HMRC requirement).

 

We securely delete or anonymise data when it’s no longer needed.

​

7. Who has access to my / my team’s data?

​

Internally: Only authorised staff who need access to operate, support, or improve the service. Access is role-based and logged.

​

Trusted providers: We use vetted third-party processors (e.g., web hosting, learning platform, payment services, email tools, analytics). They must process data only on our instructions, keep it secure, and comply with data-protection law. We do not permit them to use your data for their own marketing.

​

Storage & location: Data is stored in the UK or EEA where possible. If processing occurs outside the UK/EEA, we use approved safeguards (e.g., UK Addendum/SCCs).

​

We never sell personal data.

​

8. Cookies

We use cookies to run the site and learning platform, remember preferences, and understand usage. Non-essential cookies (e.g., analytics) operate on consent or are controllable via our cookie banner.

​

See our separate Cookie Policy for details, including how to manage preferences. Some analytics/marketing tools may also use limited tracking in emails (opens/clicks); you can opt out of marketing at any time.

​

9. Working practices

​

• Devices are password-protected and locked when unattended.

• Data is accessed via secure tools and least-privilege permissions.

• Personal data sent externally is transferred securely; files containing personal data are protected in transit.

• Staff avoid local copies wherever possible and update central records only.

• We take reasonable steps to keep data accurate and up to date; contact info@thesurveyingacademy.co.uk  to request corrections.

 

10. Data breaches

​

A personal data breach is any security incident leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.

​

If we become aware of a breach:

• We will assess risk promptly.

• Where required, we will notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware of the breach.

• If the breach is likely to result in a high risk to individuals, we will communicate it to affected individuals without undue delay.

• We document all breaches in our internal register.

​