Privacy Policy

1. Who We Are

Carnaby Creative Limited is a company registered in England and Wales. For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, the data controller is Carnaby Creative Limited.

Contact email: enquiries@stevencarnaby.com

2. Information We Collect

We may collect and process the following personal data:

  • Account information: your name, email address, organisation (if provided), and password when you register for an account
  • Course data: your enrolment records, progress through courses, quiz results, and completion dates
  • Enquiry data: your name, email, organisation, and message content when you submit an enquiry form
  • Payment data: payment information is processed securely by our payment provider, Stripe. We do not store your card details on our servers
  • Technical data: IP address, browser type, device information, and cookies (see our Cookie Policy for details)
  • Organisation data: for bulk purchasers, we process learner names and email addresses provided by the organisation’s administrator

3. How We Use Your Data

We use your personal data to:

  • Provide and manage your account and access to our e-learning platform
  • Process payments and issue invoices
  • Track and report on course progress and completion
  • Issue certificates of completion
  • Respond to enquiries and provide customer support
  • Send transactional emails (purchase confirmations, welcome emails, course reminders, completion notifications)
  • Improve our website, courses, and services

4. Legal Basis for Processing

We process your data on the following legal bases:

  • Contract: processing necessary to fulfil our agreement with you (e.g. providing access to purchased courses)
  • Legitimate interests: improving our services, ensuring platform security, and communicating with you about your account
  • Consent: where you have given us explicit permission (e.g. marketing communications, if applicable in future)

5. Data Sharing

We do not sell your personal data. We may share your data with:

  • Stripe (payment processing)
  • Our web hosting provider
  • Your organisation’s administrator (if you are enrolled via an organisational bulk purchase, your name, progress, completion status, and certificate details may be visible to your organisation’s designated manager)

6. Data Retention

We retain your personal data for as long as your account is active or as needed to provide our services. Course completion records and certificates are retained for the validity period of the certificate. If you request account deletion, we will remove your personal data within 30 days, subject to any legal obligations requiring us to retain certain records.

7. Your Rights

Under UK GDPR, you have the right to:

  • Access the personal data we hold about you
  • Request correction of inaccurate data
  • Request deletion of your data
  • Object to or restrict processing of your data
  • Request portability of your data
  • Withdraw consent at any time (where consent is the basis for processing)

To exercise any of these rights, contact us at enquiries@stevencarnaby.com.

8. Cookies

Our website uses cookies. For full details, please see our Cookie Policy.

9. Changes to This Policy

We may update this privacy policy from time to time. Any changes will be posted on this page with an updated revision date.

10. Contact and Complaints

If you have any questions about this policy or wish to make a complaint, please contact us at enquiries@stevencarnaby.com. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.