Privacy Policy
How ISO Academy uses personal information across our website, training platform and enquiries.
Updated 15 October 2026.
Who we are
ISO Academy Limited, company number 12542559, is responsible for personal information used to run our website, course sales and customer enquiries. Our registered office is 2 Lupton Road, Fradley, Lichfield, England, WS13 8XN. For privacy questions or to exercise your rights, email hello@iso-academy.com.
This notice covers iso-academy.org.uk, our learning storefront at www.iso-academy.com, and enquiries about training, consultancy and Compliance Cloud. Where an organisation provides personal information for a managed service, the relevant service agreement also governs our handling of that information. Contact your organisation about information it controls within its own management system.
Information we use and why
| Activity and information | Purpose and lawful basis |
|---|---|
| Enquiries: your name, email, optional phone and organisation, enquiry type and message. | To answer your question, provide a quotation or support you. We rely on steps requested before entering a contract, performance of our contract where applicable, or our legitimate interest in responding to enquiries and running our business. |
| Course accounts and purchases: account details, order and payment status, enrolments, learning progress, assessments and certificates. | To supply the course, manage access, provide support and evidence completion. We rely on performance of the contract, legal obligations for relevant accounting records, and legitimate interests in resolving disputes and protecting the service. |
| Compliance Cloud enquiries and demo access: contact details, organisation and information you choose to provide about your requirements or readiness check. | To provide the requested demo or response, discuss the requested service and maintain related business records. We rely on pre-contract steps or our legitimate interests in responding to business enquiries. Opening a demo does not itself subscribe you to marketing. |
| Website operation: technical request information, security events, cookie choices and short-lived abuse-prevention checks. | To operate and protect the website and respect your choices. We rely on our legitimate interests in keeping the service secure and available, and applicable legal obligations. |
| Optional analytics: page views, selected links and events such as an enquiry being submitted or a purchase being completed. | To understand which pages and journeys are useful and improve the website. Optional analytics is controlled by your cookie choices. Our custom event tracking does not send enquiry text, names or email addresses to Google Analytics. |
Please avoid sending payment-card details, special-category personal information or confidential third-party records through the public contact form. Payment details are handled through the checkout’s payment providers; they should not be emailed to us.
Cookies and analytics
Essential technologies support functions such as security, sign-in and remembering your privacy choices. Optional analytics on our marketing pages uses Google Analytics 4. Where consent is required, it is requested before optional analytics is enabled. You can accept or reject optional analytics and change your choice through the cookie controls on the relevant site.
The main website uses WPConsent to manage cookie preferences. The training storefront has its own cookie controls because it is on a separate domain. Google Analytics can process online identifiers and device information; it is not accurate to describe analytics as collecting no personal information. See Google’s privacy information.
Service providers and sharing
We use providers to host and secure our website, deliver email, run the learning platform and process payments. Thinkific provides the course platform and checkout; see Thinkific’s privacy policy. The available payment provider is identified during checkout. Google provides optional website analytics. We may also use email-marketing services to manage communications where permitted.
We do not sell your personal information. Information may be shared with professional advisers, authorities or other parties where necessary to comply with law, protect legal rights, investigate misuse or support a business transfer, subject to applicable safeguards.
Some service providers operate internationally. Depending on the provider and service, information may be processed outside the UK. Applicable transfer protections may include an adequacy decision or approved contractual safeguards. Contact us if you need details of the arrangements relevant to your information.
Marketing choices
You can unsubscribe from marketing using the link in an email or by contacting us. Where consent is required, we obtain it separately. Sending an enquiry is not consent to unrelated marketing. We may retain enough information to respect an unsubscribe request.
How long information is kept
We keep information for the purposes for which it was collected and for any necessary legal, accounting, dispute-resolution or security period. Retention depends on the information: enquiries are needed while we resolve the matter and related follow-up; account and learning records support course delivery, certificates and support; transaction records may need to be retained under accounting and tax requirements. We review information against these purposes rather than keeping it indefinitely without a reason.
The 180-day course access period controls access to learning materials; it does not mean all account, certificate or transaction records are deleted on day 180. Contact us for information about retention or deletion relating to your account.
Your rights
Depending on the circumstances, you may ask to access, correct, erase, restrict or receive a portable copy of your personal information. You may withdraw consent where we rely on it; this does not affect the lawfulness of processing before withdrawal. Some rights are subject to exceptions, including where information must be kept to meet legal obligations.
You have the right to object to direct marketing at any time. You may also object to processing based on legitimate interests because of your particular circumstances.
Email hello@iso-academy.com with your request. We may need to verify your identity before disclosing or changing account information. Requests are normally free; charges or refusal are only considered where the law permits, with an explanation.
Security and complaints
We use technical and organisational measures to protect information and restrict access to those who need it. No internet service can guarantee absolute security. Keep your account credentials private and tell us promptly about a suspected account problem.
Please contact us first if you have a concern. You may also complain to the UK Information Commissioner’s Office through ico.org.uk/make-a-complaint, or to the data-protection authority available to you in your country.
Changes to this notice
We may update this notice when our services or practices change. The date above identifies the current version. Material changes requiring a separate notification or consent will be handled as required by applicable law.