Privacy &
Data Protection Policy
Protecting personal information. Building trust through accountability.
Learn how JL Academy collects, uses, stores and protects personal data, including our approach to UK GDPR compliance, information security, privacy rights and responsible information sharing.
Protecting information. Respecting people.
At JL Academy Ltd, we respect the privacy of everyone who engages with our organisation.
Responsible information handling is essential to the trust placed in us by learners, employees, associates, clients, commissioning organisations and professional partners.
This Privacy & Data Protection Policy explains what personal information we collect, why we use it, how we protect it, when it may be shared and the rights individuals have concerning their personal data.
We aim to process personal information lawfully, fairly, transparently and securely, in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable data protection legislation.
Clear responsibility. Accountable governance.
JL Academy Ltd is a company registered in England and Wales. For personal information processed for our own business purposes, we are ordinarily the data controller under UK data protection law.
JL Academy Ltd
Company number: 16279502
Registered office:5th Floor
167–169 Great Portland Street
London
W1W 5PF
United Kingdom
Website:
jl-academy.com
Director-led oversight.
JLA’s Directors share responsibility for overseeing data protection, information governance and organisational security arrangements.
James Hourihan, Director and designated Data Protection Lead, coordinates JLA’s data protection arrangements, including privacy enquiries, regulatory updates, information security procedures and personal data incident escalation.
Both Directors participate in decisions concerning information systems, processing activities and access controls.
Questions about your personal information?
For privacy enquiries, requests to exercise your data protection rights or concerns about how JLA handles personal information, please contact:
Your enquiry will be directed to the appropriate person, including JLA’s Data Protection Lead where required.
Respecting everyone who works with us.
Our privacy arrangements apply to individuals who engage with JL Academy through our website, professional services, training programmes and organisational relationships.
Learners & Delegates
Individuals participating in our training, professional development, workshops and specialist programmes.
Clients & Commissioners
Representatives of organisations commissioning training, consultancy and related professional services.
Trainers & Associates
Employees, consultants, trainers, associates and subcontractors working with JLA.
Website Visitors
Individuals visiting our website, completing enquiries or interacting with relevant online services.
Professional Contacts
Partners, professional connections, applicants and other individuals communicating with our organisation.
Other Relevant Individuals
Individuals whose information is legitimately required in connection with JLA’s services, governance or professional responsibilities.
What information do we collect?
The information we collect depends on the nature of your relationship with JLA. We aim to collect only what is appropriate and necessary for the relevant purpose.
Contact Information
Names, professional roles, job titles, organisations, email addresses, telephone numbers and relevant correspondence addresses.
Learning Records
Bookings, attendance, programme participation, relevant eligibility details, assessments, completion outcomes and certificates.
Billing & Contracts
Billing details, invoices, purchase orders, transaction references and information needed to manage contractual arrangements.
Qualifications & Experience
Relevant professional registration, experience, qualifications and information needed to establish suitability for particular roles or programmes.
Enquiries & Feedback
Correspondence, enquiries, complaints, evaluation responses and information voluntarily provided during communication.
Website & Technical Data
Technical identifiers, IP addresses, device or browser information, website security logs and cookie preferences, where collected.
Handling sensitive information carefully.
Where necessary, we may process information about accessibility requirements, reasonable adjustments or individual support needs.
Some information, such as health-related details, may constitute special category personal data under UK GDPR. We will only process this information where an appropriate lawful basis and additional legal condition apply.
We encourage individuals not to provide unnecessary medical or sensitive personal information.
Information collected with a clear purpose.
We receive information through our professional activities, including direct enquiries, training administration, employment relationships and organisational commissions.
Information you provide.
Enquiries, correspondence, course registrations, feedback, applications, and information shared during professional discussions.
Information shared appropriately.
Booking information provided by commissioning organisations, authorised delivery partners, trainers or other legitimate professional sources.
We may also use relevant publicly available professional information where lawful. Where information is supplied by another organisation, applicable transparency obligations will be considered.
Lawful, necessary and proportionate.
We process personal information to respond to enquiries, deliver services, maintain appropriate records and meet our legal and professional responsibilities.
Contracts & Delivery
Managing appropriate bookings, delivering agreed services and taking requested steps before entering into individual contracts.
Possible basis: Contract or legitimate interests, according to the relationship.
Legal Obligations
Maintaining records and meeting applicable financial, regulatory and other legal responsibilities.
Possible basis: Legal obligation.
Training Records
Administering participation, assessment, completion and certification requirements.
Possible basis: Contract, legitimate interests or legal obligation, as applicable.
Protecting Our Services
Maintaining proportionate website security, organisational systems and operational integrity.
Possible basis: Legitimate interests or applicable legal obligation.
Complaints & Enquiries
Responding to concerns, investigating appropriate matters and managing requests concerning personal information.
Possible basis: Legitimate interests or legal obligation, as applicable.
Professional Marketing
Providing relevant communications about our services where permitted by data protection and electronic marketing rules.
Possible basis: Consent or another legally permitted basis.
Responsible training record management.
Some professional training programmes require us to maintain appropriate records of attendance, participation, assessment and certification.
Accurate programme records.
Depending on the programme, we may maintain booking information, attendance records, eligibility information, assessment outcomes, completion dates and certificate details.
These records support training delivery, professional accountability and applicable programme requirements.
Appropriate information sharing.
Some programmes require information to be shared with authorised programme owners or certification organisations, including Timian where applicable.
We aim to disclose only the information necessary for the relevant administrative or certification purpose.
Protecting information across our systems.
JL Academy uses IONOS to provide website hosting infrastructure. The information processed by the hosting provider depends on the services and technical configuration in use.
IONOS Infrastructure
Supporting the availability and operation of our website, including relevant technical and hosting information.
Director Oversight
JLA retains responsibility for determining appropriate handling and protection of personal information under its control.
Proportionate Controls
We aim to maintain appropriate access management, secure information handling, system maintenance and risk-based security arrangements.
Sharing only where appropriate and necessary.
We may share relevant personal information with authorised suppliers, trainers, professional partners and service providers where necessary for legitimate business activities or legal obligations.
IONOS
Provides JLA’s website hosting infrastructure and associated technical services.
Microsoft 365
Supports authorised communications, collaboration, document management and internal business administration.
Mailchimp
May support marketing communications, subscription management and relevant website forms, where used.
Programme Partners
Authorised trainers, associates, programme owners and certification organisations, including Timian where applicable.
Payment Providers
Approved providers may process customer payment information when payment links or other payment facilities are used.
Arlo & Analytics
Planned training management and website analytics services will be assessed before implementation.
JLA may also work with appropriate accounting, professional advisory and business service providers. Relevant sharing arrangements depend on each organisation’s role and the purpose of processing.
We do not sell personal information to advertisers or data brokers. Appropriate contractual and data protection safeguards will be used where required.
Protecting information beyond the UK.
Some authorised providers or professional partners may process personal information outside the United Kingdom.
Where a restricted international transfer takes place, we will assess the applicable legal requirements and use an appropriate transfer mechanism, such as UK adequacy regulations, approved contractual safeguards or another lawful mechanism where available.
Individuals may request further information about relevant transfer safeguards by contacting info@jl-academy.com .
Respecting your communication preferences.
We distinguish between communications necessary to administer our services and optional information about training, consultancy or other JLA activities.
Information relevant to your booking.
We may communicate information necessary to administer enquiries, contracts, bookings, programmes and professional relationships.
These communications are distinct from optional marketing.
Your choices matter.
Mailchimp may be used for appropriate professional communications, campaigns and subscription forms.
We will seek consent where required, comply with applicable electronic marketing rules and provide suitable opt-out arrangements.
You can request that JLA stops sending marketing communications by using an available unsubscribe option or by emailing info@jl-academy.com .
Transparency in our digital services.
The JLA website may use cookies and similar technologies to support essential website functionality, security, visitor preferences and, where implemented, analytics.
Website Functionality
Technologies needed to operate the website or provide functions requested by visitors may be used where a legal consent exception applies.
Cookie Choices
Where consent is required, visitors will be offered appropriate information and a meaningful choice before relevant technologies are activated.
Google Analytics
Google Analytics is planned to help us understand website performance and improve content and visitor experience. Its configuration and consent requirements will be reviewed before activation.
Keeping information only as long as necessary.
JLA retains personal information only for as long as reasonably necessary for its intended purpose and any relevant legal, contractual or professional requirements.
Financial Records
Retained as necessary to meet relevant accounting, tax and financial obligations.
Training Records
Retained according to applicable programme, certification, contractual and legal requirements.
Complaints & Enquiries
Retained for appropriate accountability, dispute management and legal purposes.
Retention periods vary by information category. We consider the nature, sensitivity, purpose and risks associated with retaining personal information. When it is no longer required, appropriate deletion, anonymisation or secure disposal arrangements will be applied.
Understanding your UK GDPR rights.
Individuals have rights concerning their personal information under UK data protection law, subject to relevant legal conditions and exemptions.
Right to Be Informed
Receive clear information about how and why your personal data is processed.
Right of Access
Request access to personal information JLA holds about you.
Right to Rectification
Request correction of inaccurate or incomplete personal information.
Right to Erasure
Request deletion of personal information where the relevant legal conditions are met.
Right to Restrict Processing
Request restriction of certain processing activities where the right applies.
Right to Data Portability
Receive qualifying personal data in a portable format where applicable.
Right to Object
Object to particular processing activities, including certain processing based on legitimate interests.
Automated Decision-Making
Receive applicable protections in relation to qualifying significant decisions made solely through automated processing.
Withdrawal of Consent
Withdraw consent where consent is the lawful basis, without affecting previous lawful processing.
Raising concerns about personal information.
If you are concerned about how JLA collects, uses, shares, retains or protects personal information, we encourage you to contact us.
Tell us about your concern.
Email info@jl-academy.com and provide sufficient information for us to understand and consider the matter.
We aim to acknowledge complaints within five working days.
For data protection complaints, we will comply with the statutory acknowledgement requirement of 30 calendar days.
We will investigate appropriately, provide relevant updates and communicate an outcome without undue delay.
Information Commissioner’s Office.
Individuals may also raise concerns with the Information Commissioner’s Office (ICO), the UK’s independent information rights regulator.
Our internal process does not remove your right to contact the ICO.
Responding to information security incidents.
We take suspected personal data breaches seriously. This includes potential loss, unauthorised disclosure, accidental alteration or inappropriate access to personal information.
Assessment
Suspected incidents will be assessed to understand their nature, consequences and potential risks to individuals.
Regulatory Notification
Where notification to the ICO is legally required, JLA will comply with the applicable notification timeframe.
Individual Notification
Where a breach is likely to result in a high risk to individuals, affected people will be informed when legally required.
Potential data security concerns should be reported promptly to info@jl-academy.com .
Appropriate safeguards for young people.
JLA’s training and consultancy services are principally designed for adults and professional organisations.
Where our activities involve information relating to children or young people, we will consider appropriate safeguarding, privacy and information handling requirements for the circumstances.
We do not intentionally request unnecessary information about children through our general website enquiry arrangements.
Accountability through good governance.
Information governance is overseen jointly by JLA’s Directors and reviewed as our services, suppliers, systems and legal responsibilities evolve.
Director-led governance.
Data controller: JL Academy Ltd
Data Protection Lead: James Hourihan, Director
Oversight: Joint Directors
Privacy contact: info@jl-academy.com
Keeping arrangements appropriate.
This policy will be reviewed at least annually, or sooner following relevant legal, operational or technological changes.
JLA maintains an internal Data Protection & Information Assets register to support oversight of processing activities, service providers and information governance actions.
New systems, including planned training management and analytics facilities, will be reviewed as part of implementation.
Privacy matters.
Trust matters more.
Protecting personal information is an important part of the respect, professionalism and accountability that shape our work. We aim to handle information transparently, proportionately and responsibly.
Contact JL Academy