Legal

Privacy Policy

Last updated: 21 October 2026

1. Introduction, scope and controller

1.1 Summary. This summary is for convenience only, and the rest of this Privacy Policy gives the full detail:

What we collect. We collect the details that you give us, such as your name, email address and Order information, and some technical data that is collected automatically when you use the Website.
Why we collect it. We use it to provide and deliver the Products and Services, to take payment, to give support, to keep the Website secure and, where you agree or the law allows, to send you marketing.
No sale for money. We do not sell Personal Data for money.
Who we share it with. We share it with service providers, such as the Payment Processor, hosting and email providers, and with authorities where the law requires.
How long we keep it. We keep it only for as long as needed for the purposes in this Privacy Policy, and clause 13 sets out the periods.
How to contact us. You can write to us at [email protected] to use your rights or to ask a question.

1.2 Who we are. Quill and Crest is the controller of the Personal Data that this Privacy Policy describes, and in some countries is called the “responsible party”. We do not publish a postal address, a registration number or a tax number, and you can contact us about privacy at [email protected].

1.3 Data protection contact and representatives. We have appointed a person responsible for data protection matters, who can be contacted at [email protected]. Where Applicable Data Protection Law requires us to appoint a representative in the European Economic Area or the United Kingdom, we will do so and publish the contact details here.

1.4 Who this Privacy Policy covers. This Privacy Policy applies to visitors to the Website, customers, learners, subscribers, clients and Affiliate Partners. It covers the Website at https://quillandcrest.com, our Products and Services, and our online and offline dealings with you.

1.5 What it does not cover. This Privacy Policy does not cover the practices of third parties, including the Third-Party Platforms that you reach through links. It also does not cover Personal Data that you process about other people through a Product, which clause 23 explains.

1.6 Relationship to the Terms of Use. This Privacy Policy forms part of our Terms of Use at https://quillandcrest.com/terms-of-use/. Capitalised terms that are not defined here have the meaning that the Terms of Use give them.

1.7 Regional supplements. Clause 27 introduces the regional supplements in Schedules 3, 4 and 5. For people whom a supplement covers, the supplement prevails over the main text of this Privacy Policy if the two differ.

1.8 Your acknowledgement. By using the Website, you acknowledge that you have read this Privacy Policy. This acknowledgement is not consent: where the law requires your consent for something that we do, we will ask for it separately and you may decline.

2. Definitions and interpretation

2.1 Definitions. In this Privacy Policy, these words have the following meanings:

Applicable Data Protection Law means the data protection and privacy laws that apply to the Processing in question, including the European Union General Data Protection Regulation, the United Kingdom General Data Protection Regulation and the Data Protection Act 2018, the Swiss Federal Act on Data Protection, the privacy laws of the states of the United States, including the California Consumer Privacy Act as amended, the Nigeria Data Protection Act 2023, the Personal Information Protection and Electronic Documents Act and provincial laws in Canada, the Privacy Act 1988 in Australia, the Lei Geral de Proteção de Dados in Brazil, the Protection of Personal Information Act in South Africa, and similar laws.

Controller means the person that decides why and how Personal Data is Processed, and includes a “responsible party” and an equivalent under Applicable Data Protection Law.

Cookies means small text files that are stored on your device, and similar technologies such as pixels, web beacons, local storage, software development kits and device identifiers.

Data Subject means the individual to whom Personal Data relates.

Personal Data means any information that relates to an identified or identifiable individual, and includes “personal information” and equivalent terms under Applicable Data Protection Law.

Processing means any operation on Personal Data, such as collecting, recording, storing, using, sharing or deleting it, and “Process” has a matching meaning.

Processor means a person that Processes Personal Data on behalf of a Controller, and includes a “service provider”, a “contractor” and an equivalent.

Regulator means a public authority that supervises Applicable Data Protection Law, such as a data protection authority, a commissioner or an information regulator.

Sensitive Data means Personal Data that Applicable Data Protection Law treats as needing extra care, including government identifiers, precise geolocation, biometric data, health data and information about children.

Third-Party Platform has the meaning that the Terms of Use give it.

2.2 Terms defined in the Terms of Use. The words Account, Affiliate Partner, Coaching Services, Course, Ebook, Event, Order, Payment Processor, Product, Service, Software and Subscription have the meanings that the Terms of Use give them.

2.3 Interpretation. The word “including” means “including without limitation”, headings are for convenience only, and a reference to a law includes that law as amended or replaced. Where a term in this Privacy Policy is used in a way that Applicable Data Protection Law defines differently for a person in a region, the meaning that the law gives applies to that person.

3. Personal Data we collect

3.1 Data that you give us. We collect the Personal Data that you give us when you use the Website, place an Order or contact us. It may include the following:

(a) identity and contact details, such as your name, email address and country;

(b) Account credentials, which we store only in hashed form;

(c) Order and billing information, where the Payment Processor holds your full payment card details and we see only limited data, such as the card brand, the last four digits, the billing country and the Order value;

(d) learning inputs, such as assignments, quiz answers and the proof of effort that you submit with a refund request;

(e) support messages and the correspondence that you send us;

(f) answers to surveys and feedback that you choose to give;

(g) reviews, comments and testimonials that you submit;

(h) registration details for Events;

(i) intake information that you give us for Coaching Services;

(j) application and payout details, if you apply to become an Affiliate Partner; and

(k) a photograph or likeness, but only if you choose to send one.

3.2 Data that we collect automatically. When you use the Website or a Product, we and our providers collect some data automatically. It may include:

(a) device and browser data, such as the type of device, operating system and browser;

(b) your IP address and the approximate location that it shows;

(d) Cookies and similar technologies, as clause 9 and Schedule 1 describe;

(e) licence, activation and download data;

(f) video playback data, such as the points at which you play, pause or finish; and

(g) email interaction data, such as whether you open an email and which links you click.

3.3 Data from other sources. We may receive Personal Data about you from others, including:

(a) the Payment Processor, which tells us about your Order and its status;

(b) Third-Party Platforms that you use to reach us or that deliver parts of a Product;

(d) public sources and service providers that help us check for fraud, abuse and sanctions risks; and

(e) social platforms, if you choose to connect an account from one of them to ours.

3.4 Sensitive Data. We do not intend to collect Sensitive Data, and we ask you not to send it to us. If you volunteer Sensitive Data in a support message or in Coaching Services, we use it only to respond to you and for no other purpose.

3.5 Information that you must give. Some Personal Data is needed so that we can provide a Product, take payment or comply with the law. If you do not give it, we may not be able to complete your Order or provide the Product, and we will tell you when this applies.

3.6 Accuracy. You should give us accurate and current Personal Data and keep it up to date through your Account or by writing to [email protected]. We rely on the information that you give us, and we are not responsible for problems that arise from details that are wrong or out of date.

3.7 Combining data. We may combine the Personal Data that we collect from different sources, for example to match an Order with an Account or a support message. We combine it only for the purposes in clause 4.

3.8 Anonymous and aggregated data. We may create data that does not identify you, such as totals of visits or sales. This data is not Personal Data, and we may use it for any lawful purpose.

4. How we use Personal Data and our legal bases

4.1 Purposes and legal bases. We Process Personal Data only for specific purposes. The table below lists those purposes together with the categories of Personal Data involved and the legal basis on which we rely.

The table below sets out why we Process Personal Data and the legal basis on which we rely under Applicable Data Protection Law. Where a law does not use legal bases, the table describes the reason for the Processing.

Purpose	Main categories of Personal Data	Legal basis
To create and manage your Account and to identify you	Identity and contact; account; technical	Performance of a contract; legitimate interests (account security)
To process Orders, take payment, issue receipts and deliver Products	Identity and contact; order and billing; access and download	Performance of a contract; legal obligation (tax and accounting records)
To provide course delivery, track progress and issue certificates	Account; learning and progress; video playback	Performance of a contract; legitimate interests (delivering and improving the learning experience)
To manage licences, prevent piracy and unauthorised sharing and enforce our Terms of Use	Licence and security; access and download; IP address; watermark identifiers	Legitimate interests (protecting our intellectual property and revenue); performance of a contract
To provide customer support and respond to enquiries	Identity and contact; support and correspondence; order	Performance of a contract; legitimate interests (providing support and keeping records)
To assess and process refund, cancellation and chargeback claims	Order and billing; refund and dispute data; learning and progress; proof of effort	Performance of a contract; legitimate interests (verifying eligibility and preventing abuse); establishment, exercise or defence of legal claims
To send service messages (receipts, access, security, policy and renewal notices)	Identity and contact; order; account	Performance of a contract; legal obligation; legitimate interests
To send marketing communications about our Products and Services	Identity and contact; marketing; email interaction	Consent, or legitimate interests or another basis permitted by Applicable Data Protection Law in respect of existing customers, with a right to opt out at any time
To run analytics, measure performance and improve the Website, Products and Services	Technical; usage and log; Cookie data	Consent where required for non-essential Cookies; otherwise legitimate interests
To personalise content and offers and to measure and optimise advertising	Technical; usage; marketing; Cookie data	Consent where required; otherwise legitimate interests
To publish reviews, comments and testimonials	Identity; content you submit; photograph or likeness where you provide one	Consent; legitimate interests (moderation)
To run live sessions, coaching and events	Identity and contact; content; session data; recordings	Performance of a contract; consent (recordings); legitimate interests
To administer the affiliate programme and pay commissions	Affiliate data; referral attribution; payout and tax data	Performance of a contract; legal obligation
To detect, prevent and investigate fraud, abuse, security incidents and unlawful activity, and to screen against sanctions lists	Identity; order; technical; licence and security	Legitimate interests; legal obligation
To comply with legal obligations, respond to lawful requests and protect our rights	All categories as necessary	Legal obligation; legitimate interests; establishment, exercise or defence of legal claims
To conduct research, produce aggregated or anonymised statistics and develop new Products	Usage; learning and progress; feedback (aggregated or de-identified where practicable)	Legitimate interests; consent where required
For corporate transactions such as a merger, acquisition or sale of assets	As necessary	Legitimate interests

Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of Processing before withdrawal. Where we rely on legitimate interests, you may object as described in clause 15.

4.2 No incompatible new uses. We do not use Personal Data for a purpose that is incompatible with the purposes in the table without first telling you. Where the law requires a new legal basis for the new purpose, we will establish one before we go ahead.

4.3 Consent where the law requires it. Where Applicable Data Protection Law requires your consent for a purpose, we obtain it before we Process Personal Data for that purpose. You may refuse consent, and refusing will not by itself affect your access to the Products, except where the Processing is needed to provide them.

4.4 Automated decisions. We do not make decisions that have legal or similarly significant effects on you solely by automated means. Clause 17 explains how people are involved in our decisions about refunds and Accounts.

4.5 Relying on legitimate interests. Where we rely on our legitimate interests, we have considered whether those interests are outweighed by your rights and freedoms, and we use the information that we need and no more. You may ask us how we reached that view, and you may object to the Processing, as clause 15 explains.

4.6 Using data for a different purpose. If we want to use Personal Data for a purpose other than the one for which we collected it, we first check that the new purpose is compatible with the original one. Where it is not compatible, we tell you and, where the law requires, we ask for your consent.

4.7 Required and optional data. Some of the purposes in the table cannot be met without the Personal Data that is listed for them, such as taking payment or delivering a Product. Other Processing, such as marketing and analytics, is optional, and you can say no without losing access to what you have bought.

4.8 Joint purposes. One piece of Personal Data may serve more than one purpose in the table, for example your email address, which we use both to deliver a Product and to answer a support request. In each case, we use it only for the purposes that apply, and we apply the retention period that fits.

5. Payments, Orders and merchant of record

5.1 The Payment Processor. The Payment Processor acts as the merchant of record for your Order. For payment, tax and fraud processing, it is an independent Controller of the Personal Data that you give it at checkout.

5.2 Its privacy policy. The privacy policy of the Payment Processor governs the payment data that it collects. You should read it, because we do not control how the Payment Processor uses the data for its own purposes.

5.3 What we receive. We receive limited Order data from the Payment Processor, such as your name, email address, the Product, the Order value, the billing country and the status of the payment. We do not store your full payment card number.

5.4 International transfers. The Payment Processor may transfer Personal Data internationally under its own arrangements. Clause 12 explains how international transfers work.

5.5 Tax data and invoices. The Payment Processor calculates and collects tax where the law requires, and it issues invoices and receipts. We keep the records that we need for our own tax and accounting duties, for the periods in clause 13.

5.6 Refunds and chargebacks. The Payment Processor shares refund and dispute data with us. To answer a dispute, we may share your proof of effort and Account data with the Payment Processor, and we do so only to the extent that the dispute needs.

5.7 Fraud screening. The Payment Processor and we may screen Orders to detect fraud. A screening result may lead us to cancel an Order or ask you for more information, and a person reviews any decision that significantly affects you, as clause 17 states.

6. Accounts, product delivery and learning data

6.1 Account creation and login. We Process your name, email address and login details to create your Account and to let you log in. We store passwords in hashed form, and we use login data to keep your Account secure.

6.2 Delivery of Products. We deliver Products by download link, access through a learning platform or a licence key. To do this, we Process your Account details, your Order details and data about your downloads and access.

6.3 Learning data. Where you use a Course, we Process your progress, your quiz results, your completion status and any certificate that we issue. A certificate may show your name and the date.

6.4 Video playback. We and the video platform that delivers a Course collect playback data, such as the lessons that you watch and where you stop. We use this data to deliver the Course and to understand how it is used.

6.5 Refund verification. The Terms of Use set conditions for refunds of Courses. We use your progress records, and the proof that you submit, to assess whether those conditions are met.

6.6 Limits on use. We do not use learning data to make decisions about you other than to provide the Course and to assess refund requests. A person reviews every refund decision, as clause 17 states.

6.7 Learning platforms. The platforms that deliver Courses act as Processors on our instructions, except where a platform is the Controller of its own account data. Schedule 2 lists the categories of providers.

6.8 Support and Account records. When you contact us about your Account or a Product, we keep a record of your message, our reply and the steps that we took. We use these records to resolve your query, to improve the Products and to answer any later question about the same matter.

6.9 Access history. We keep a record of when and from where your Account is used, such as the dates of login and the downloads that you make. We use it to help you if you lose access and to detect use that does not look like yours.

6.10 Closing your Account. If you ask us to close your Account, we delete or anonymise your Account data as clause 13 explains, except for the records that we must or may keep. Closing an Account ends your access to the Products linked to it.

7. Licence, anti-piracy and security data

7.1 Purposes. We Process certain data to enforce licences, to detect unauthorised sharing, to protect the Products and the Website and to prevent fraud. We do this because the Products are valuable to us and to those who buy them lawfully.

7.2 Data involved. This Processing may involve your IP address, device identifiers, activation and download logs, login patterns and, where we use them, watermark identifiers that are embedded in files. We collect only the data that these purposes need.

7.3 Legal basis and balance. Our legal basis is our legitimate interest in protecting our Intellectual Property Rights and revenue, and in some cases the performance of a contract with you. We have weighed that interest against your rights, and we believe that the Processing is proportionate because it is limited to what is needed and is not used for other purposes.

7.4 Retention. We keep licence and security data for the periods in clause 13. We keep it for longer only where a confirmed infringement or a claim makes this necessary.

7.5 Consequences of infringement. If we confirm unauthorised sharing, we may suspend or end your access, as the Terms of Use state. We may also take legal action, and we may share evidence with our legal advisers and with courts and authorities where this is needed.

7.6 Who sees this data. Only the people and providers that need licence and security data to do their work can see it. They include our hosting and security providers, who act as Processors, and our professional advisers where a matter needs their help.

7.7 Your choices. You can reduce the data that we collect for these purposes by using your licence on the devices that the Product Page permits and by not sharing your Account. If you think that we have wrongly flagged your use, you may write to [email protected] and ask us to review it, and a person will do so.

7.8 Anonymised statistics. We may combine licence and security data into statistics that do not identify you, for example to see how many downloads a Product receives. We may keep and use those statistics without a time limit.

8. Marketing and email communications

8.1 What we send. We may send you newsletters, offers and news about our Products and Services. We send them only where the law allows.

8.2 Basis. We send marketing on the basis of your consent or, where the law permits, on the basis of the rules that apply to existing customers, such as a soft opt-in. Table row 8 in clause 4 gives the legal basis.

8.3 Unsubscribing. Every marketing email includes an unsubscribe link, and you may also write to [email protected] to opt out. Unsubscribing stops marketing, but it does not stop service messages, such as receipts, access notices and security messages.

8.4 Email tracking. Our emails may contain tracking pixels and links that record whether you open a message and which links you click. You can limit this by blocking images in your email program or by changing the settings of your email provider.

8.5 Segmentation. We may divide our email list into segments based on your purchases and interests, so that we send you more relevant messages. We do this only within the limits that the law and your choices allow.

8.6 Email service provider. We use an email service provider, which acts as a Processor on our instructions. We do not sell or rent our email lists to anyone.

8.7 Other channels. We use text messages or push notifications only if you have opted in to them, and you may opt out at any time through the message or by writing to us.

8.8 Suppression record. If you opt out, we keep a minimal suppression record so that we do not contact you again. Clause 13 states how long we keep it.

8.9 Marketing laws. We follow the marketing and email rules that apply to us, including the United States CAN-SPAM Act, the Canadian anti-spam law, and the privacy and electronic communications rules of the European Union and the United Kingdom.

9. Cookies and similar technologies

9.1 What Cookies are. Cookies are small text files that a website stores on your device. Similar technologies, such as pixels and local storage, do the same job, and we call them all Cookies in this Privacy Policy.

9.2 Categories. We use four categories of Cookies:

(a) strictly necessary Cookies, which keep the Website secure and working, such as those that keep you logged in or complete a checkout;

(b) functional Cookies, which remember your choices, such as your display settings;

(d) marketing Cookies, which measure advertising and help us show relevant offers.

9.3 Consent. Strictly necessary Cookies do not need your consent. For other Cookies, we ask for your consent through our cookie banner where Applicable Data Protection Law requires it, and we do not set non-essential Cookies before you agree where consent is required.

9.4 Changing your choice. You can change your cookie choices at any time through the cookie settings link in the footer of the Website. You can also block or delete Cookies through your browser settings, although doing so may affect how the Website works.

9.5 Global Privacy Control. We treat the Global Privacy Control signal as an opt-out of sale, sharing and targeted advertising, where Applicable Data Protection Law requires us to do so.

9.6 Full list. Schedule 1 lists the types of Cookies that we use, who provides them, how long they last and whether they are first-party or third-party Cookies.

10. Disclosure and sharing of Personal Data

10.1 Principles. We share Personal Data only as far as is needed for the purposes in this Privacy Policy. Where we share it with a Processor, the Processor acts on our instructions and is bound by a contract that requires it to protect the data.

We share Personal Data with the following categories of recipients, only to the extent necessary for the purposes described in this Privacy Policy. We do not sell Personal Data for money. Some of these disclosures may be treated as “sharing” under certain United States state laws, as Schedule 4 explains.

Category of recipient	Why we share Personal Data	Role of the recipient
Payment Processors, merchants of record and marketplaces	To take payment, deliver Orders, issue invoices, calculate tax, and handle refunds and disputes	Independent Controller (and, for some functions, Processor)
Hosting, database, storage and file-delivery providers	To host the Website and Products and deliver files securely	Processor
Course, learning-management and video-hosting platforms	To deliver Courses and video content and track progress	Processor, or independent Controller of its own account data
Email, messaging, customer-relationship and help-desk providers	To send communications, manage contacts and provide support	Processor
Analytics, advertising and measurement providers	To measure performance and, where permitted, to measure and optimise advertising	Processor or independent Controller, depending on the service
Scheduling, video-conferencing and recording providers	To run coaching sessions, webinars and live events	Processor
Affiliate platforms and payout providers	To track referrals and pay commissions	Processor or independent Controller
Code-hosting and software-delivery providers	To grant access to repositories, releases and updates	Independent Controller of its own account data
Artificial-intelligence service providers	To provide AI-assisted features, transcription, translation or support	Processor
Fraud-prevention, security and identity-verification providers	To detect fraud, abuse and sanctions risks	Processor or independent Controller
Professional advisers (lawyers, accountants, auditors, insurers)	To obtain advice, comply with law and manage risk	Independent Controller or Processor
Regulators, courts, law-enforcement and other authorities	To comply with law or lawful requests, or protect rights and safety	Independent Controller
A successor or counterparty in a corporate transaction	In connection with a merger, acquisition, financing or sale of assets	Independent Controller after the transaction

10.2 Legal disclosures. We may disclose Personal Data to a court, a law-enforcement body or another authority where a law, a court order or a valid request requires it. We may also disclose it where this is reasonably needed to protect our rights, our Intellectual Property Rights, the safety of any person or the security of the Website.

10.3 Corporate transactions. If we are involved in a merger, acquisition, financing or sale of assets, Personal Data may be transferred as part of that transaction. We will tell you of a change of control where the law requires, and the successor must continue to protect your Personal Data in line with this Privacy Policy.

10.4 With your consent. We may share your Personal Data with other people where you ask us to or where you have given your consent, for example when you agree that we may publish your testimonial with your name.

10.5 Aggregated and de-identified data. We may share aggregated or de-identified data that does not identify you, for example statistics about the use of the Website.

10.6 No sale for money. We do not sell Personal Data for money.

10.7 Register of providers. Schedule 2 lists the main categories of our service providers, with examples. On request to [email protected], we will give you the names of the providers that we currently use.

10.8 Contracts with recipients. We ask each Processor to use Personal Data only to provide its service to us, to keep it confidential and to delete or return it when the service ends. Independent Controllers handle the data under their own policies, which we encourage you to read.

11. Third-party platforms and embedded content

11.1 Embedded content. Pages of the Website and the Products may include embedded content, such as video players, social media posts, maps, forms and payment buttons. When you view or use embedded content, the provider may set Cookies and may receive data about you and your visit.

11.2 Their policies apply. The provider of embedded content acts under its own privacy policy, which we do not control. You should read that policy before you interact with the content.

11.3 Links to other sites. The Website may contain links to sites that others operate. This Privacy Policy does not cover those sites, and we are not responsible for how they collect or use Personal Data.

11.4 Signing in with another account. If we allow you to sign in or connect with an account from a Third-Party Platform, that platform shares data with us as you authorise through its own settings. We use that data only for the purposes in this Privacy Policy.

11.5 Fonts. Our Website loads fonts from Google Fonts, a service of Google. When you view a page, your browser requests the fonts from Google’s servers, which receive your IP address and device information. Google’s privacy policy explains how it handles this information.

11.6 Changes to embedded services. The services that we embed may change over time, and the Cookies that they set may change with them. Schedule 1 describes the types of Cookies in use, and we update it when the types change.

11.7 Your controls. You can limit what embedded content collects by using the cookie settings link in the footer of the Website, by changing your browser settings or by choosing not to play the content. Some embedded content will not work if you block the Cookies that it needs.

11.8 Payment buttons and checkout. If you use a payment button or a checkout page that a provider hosts, you leave the Website for the time you spend on it. The provider’s own privacy policy then applies to the data that you give it, as clause 5 explains.

11.9 Our responsibility. We choose the providers that we embed with care, and we require our Processors to protect the data that they receive from us. We cannot control what independent providers do with the data that they collect directly from you.

12. International transfers

12.1 Where data goes. We and our service providers operate in several countries, and some of them are outside the country in which you live. This means that your Personal Data may be transferred to, and Processed in, other countries.

12.2 Safeguards. Where Applicable Data Protection Law restricts such transfers, we use a lawful mechanism. Depending on the circumstances, these mechanisms include:

(a) an adequacy decision of the authority that is responsible for the transfer;

(b) standard contractual clauses approved by the European Commission;

(c) the International Data Transfer Agreement or Addendum issued for the United Kingdom, and the corresponding Swiss addendum;

(d) binding corporate rules;

(e) your explicit consent, after we have told you of the risks; and

(f) the need to carry out a contract with you or for your benefit.

12.3 Data privacy frameworks. Where a provider is certified under the European Union–United States, United Kingdom–United States or Swiss–United States data privacy framework, we may rely on that certification for transfers to it.

12.4 Copies of safeguards. You may ask us for a copy of the safeguards that apply to a transfer of your Personal Data by writing to [email protected]. We may remove commercially sensitive details before we give it to you.

12.5 The Payment Processor. The Payment Processor transfers Personal Data under its own arrangements, which its privacy policy describes. We do not control those arrangements.

12.6 Other regions. The transfer rules of Brazil, Nigeria and South Africa are described in Schedule 5. We follow them to the extent that they apply to us.

12.7 Why transfers happen. Transfers happen because our providers, such as those for hosting, email, payment and analytics, store or process data in more than one country. We have chosen providers that offer contractual or other protections for the data that they receive, but the places in which they operate can change.

12.8 Level of protection. Some countries give Personal Data a level of protection that differs from that of your own country. Where this is so, the safeguards in this clause are meant to give your Personal Data protection that is essentially equivalent to the protection that it has in your country.

12.9 Onward transfers. We require our providers to impose the same level of protection on any further provider that they use to Process your Personal Data. We ask them to tell us of the countries involved where the law requires.

12.10 Your rights. If you believe that a transfer of your Personal Data does not comply with Applicable Data Protection Law, you may write to [email protected]. You may also complain to a Regulator, as clause 15 explains.

13. Data retention

We keep Personal Data only for as long as necessary for the purposes for which we collected it, including to satisfy legal, accounting or reporting requirements, to resolve disputes and to enforce our agreements. The table sets out our standard retention periods. We may keep Personal Data for longer where the law requires or permits it, for example where there is an ongoing dispute, claim or investigation.

Category of Personal Data	Standard retention period	Reason
Account data	For the life of the Account and twelve (12) months after closure	Contract; security; handling of late queries
Order, transaction and invoice records	Six (6) years from the end of the financial year to which they relate, or any longer period that tax or accounting law applying to us requires	Legal obligation (tax and accounting)
Refund, cancellation and chargeback records, including proof of effort	Three (3) years from the date of the request, or longer where needed for a claim or a dispute with the Payment Processor	Legal claims; fraud and abuse prevention
Learning and progress data, certificates	For the life of the Account and twenty-four (24) months after closure; certificate verification records for as long as the certificate is valid	Contract; certification; refund verification
Licence, activation and download logs; watermark records	Two (2) years after the licence ends, or longer for confirmed infringements	Protection of intellectual property; legal claims
Support and correspondence about an Order, Account, refund or Product	Three (3) years from the last communication	Customer service; legal claims
Marketing list and preferences	Until you unsubscribe, plus a suppression record that is kept so that we do not contact you again; inactive subscribers are removed after twenty-four (24) months	Consent; legitimate interests
Consent records	For the life of the consent and six (6) years afterwards	Accountability
Reviews, comments and testimonials	While the content is published, subject to the clause on comments, reviews and testimonials	Consent; legitimate interests
Coaching notes and recordings	Twelve (12) months after the engagement ends, or as agreed with you in writing	Contract; quality; legal claims
Affiliate records and tax documents	Six (6) years after the end of the relationship	Legal obligation
Website logs and security logs	Thirteen (13) months	Security; legitimate interests
Analytics and cookie data	As stated in Schedule 1, and in any case no longer than twenty-five (25) months	Consent; legitimate interests
Backups	Up to ninety (90) days after deletion from live systems	Business continuity
General enquiries sent through the Website contact form	Twelve (12) months after the enquiry is closed; if the message concerns an Order, an Account or a refund, the periods for Order and refund records and for support correspondence apply instead	Customer service; handling of follow-up questions; legal claims

13.1 How we decide how long to keep data. We decide how long to keep Personal Data by considering its amount, nature and sensitivity, the risk of harm from keeping it, the purposes for which we Process it, whether we can achieve those purposes in another way and what the law requires. The periods in the table are our standard periods, and we apply them unless a different period is needed.

13.2 Deletion requests and legal retention. If you ask us to delete your Personal Data or to close your Account, we delete or anonymise it within thirty (30) days. We keep only the data that we are required or permitted to keep, such as transaction, tax and accounting records, records for legal claims, records that we need to prevent fraud and enforce licences, and a minimal suppression record for marketing opt-outs.

13.3 Restricted use of retained data. We use data that we keep for these reasons only for those reasons. We delete it when the period ends.

13.4 Closing an Account. Closing an Account ends your access to the Products and does not by itself entitle you to a refund. Refunds follow the Terms of Use.

13.5 Anonymised and aggregated data. We may keep anonymised or aggregated data without a time limit. That data does not identify you, so it is not Personal Data.

14. Security and Personal Data breaches

14.1 Our measures. We use reasonable measures, such as encryption of data in transit, access controls based on need, hashed passwords, secure hosting, confidentiality duties for staff and contractors, backups and regular reviews of our practices. We choose our providers with care and require them to protect the data that they handle.

14.2 No guarantee. No method of transmission or storage is completely secure, so we cannot promise that Personal Data will never be accessed without authority. We take reasonable steps to reduce that risk and to react quickly if it happens.

14.3 Your part. You should keep your login details confidential, use a password that you do not use elsewhere, and tell us at [email protected] at once if you think that your Account has been used without your permission.

14.4 If a breach occurs. If we become aware of a breach of security that affects Personal Data, we will assess it, contain it and act to limit harm. Where Applicable Data Protection Law requires, we will notify the Regulator and the people affected within the time that the law requires, which is in some places seventy-two (72) hours after we become aware of the breach.

14.5 Content of a notice. A notice of a breach will describe, as far as we then know, what happened, what Personal Data is involved, what we are doing about it and what you can do to protect yourself. We will keep a record of each breach and of the steps that we took.

14.6 Providers. We require our Processors to tell us without delay if they become aware of a breach that affects our data. We may also share information about a breach with our advisers and with the authorities, where this is needed.

15. Your rights and how to exercise them

15.1 Your rights. Depending on where you live and on Applicable Data Protection Law, you may have some or all of the following rights:

(a) to be informed about how we Process your Personal Data;

(b) to access the Personal Data that we hold about you;

(d) to have your Personal Data erased;

(e) to restrict how we Process it;

(f) to receive it in a portable format and to ask us to send it to another provider;

(g) to object to Processing, including Processing for direct marketing and Processing that is based on our legitimate interests;

(h) to withdraw your consent at any time;

(i) not to be subject to a decision based solely on automated Processing that has legal or similarly significant effects;

(j) to opt out of the sale or sharing of Personal Data, targeted advertising and profiling;

(k) to limit our use of your sensitive information;

(l) not to be treated unfairly because you use your rights;

(m) to complain to a Regulator; and

(n) to appeal a refusal of your request, where the law gives you that right.

15.2 How to use your rights. To use any of these rights, write to us at [email protected]. Please tell us what you want us to do and, if you can, the email address that you used for your Account or Orders.

15.3 Verifying your identity. We may need to confirm who you are before we act on a request, and the checks that we use will be proportionate to the request. If we cannot confirm your identity, we may refuse the request and will tell you why.

15.4 Agents. You may ask an authorised agent to make a request for you. We will need written authority from you, and we may still need to verify your identity.

15.5 Response time. We respond to a request within one (1) month. We may extend this period where the law allows, for example for complex requests, and we will tell you if we do. Where the law of your region sets a shorter or longer period, that period applies.

15.6 No fee. We do not charge a fee for dealing with your request. If a request is manifestly unfounded or excessive, we may charge a reasonable fee or refuse it, and we will tell you why.

15.7 Limits. Your rights are not absolute. We may refuse or limit a request where the law allows, for example to protect the rights of others, to establish or defend legal claims, to meet a legal duty to keep records or to protect trade secrets.

15.8 Deletion and retention. If you ask for deletion, we act as clause 13 explains. We may keep the data that we must or may keep, and we will tell you which.

15.9 Effect of your choices. If you withdraw consent or ask us to delete data that we need to provide a Product, we may no longer be able to provide it. This does not entitle you to a refund by itself, and the Terms of Use state when a refund is available.

15.10 Complaints. We would like the chance to deal with your concern first, so please write to us. You also have the right to complain to a Regulator, and the regional supplements in Schedules 3, 4 and 5 name the Regulators for the regions that they cover.

16. Children

16.1 Age. The Website and the Products are for people who are eighteen (18) years of age or over. We do not knowingly collect Personal Data from children.

16.2 Products designed for children. Where a Product is designed for children, it is sold to a parent or legal guardian, who creates the Account and makes the purchase. We collect only the minimum Personal Data that is needed to deliver the Product.

16.3 If we learn that we hold a child’s data. If we learn that we hold a child’s Personal Data without proper authority, we will delete it as soon as we reasonably can. We may ask you to confirm your age if we think that this has happened.

16.4 Parents and guardians. A parent or guardian who believes that a child has given us Personal Data may write to [email protected]. We will review the request and act on it promptly.

16.5 Children’s privacy laws. We respect the children’s privacy laws that apply to us, including the United States Children’s Online Privacy Protection Act and the United Kingdom Age Appropriate Design Code, to the extent that they apply.

16.6 Age checks. We do not routinely ask for proof of age, but we may ask you to confirm that you are eighteen (18) or over when you create an Account or place an Order. If you tell us that you are younger, we will close the Account.

17. Automated processing, profiling and artificial intelligence

17.1 Automated tools. We use automated tools for some tasks, such as screening Orders for fraud, personalising content, segmenting our email list and monitoring licences for sharing. These tools help us to work efficiently and to protect our customers and the Website.

17.2 No solely automated significant decisions. We do not make decisions that have legal or similarly significant effects on you solely by automated means. A person reviews decisions about refunds and Accounts, even where an automated tool has produced a first result.

17.3 Human review. You may ask for a person to review a decision that affects you by writing to [email protected]. You may also tell us your view, and we will consider it before we confirm or change the decision.

17.4 Artificial intelligence features. Where we offer artificial intelligence features, the following applies to them:

(a) your inputs are sent to artificial intelligence providers, which act as our Processors under contract;

(b) we do not use your private inputs or outputs to train general-purpose models unless you agree;

(d) you should not enter Sensitive Data or the Personal Data of other people unless you have a lawful basis to do so; and

(e) you remain responsible for what you enter and for how you use the output.

17.5 Our own use of artificial intelligence. We may use artificial intelligence tools to help create content and to provide support. Our internal use of these tools does not involve selling Personal Data, and we use them with the safeguards that this Privacy Policy describes.

17.6 Consistency with the Terms of Use. This clause is intended to work with the artificial intelligence provisions of the Software clause in the Terms of Use. If the two appear to differ, we will read them together in the way that gives you the greater protection.

17.7 Advertising profiles. Profiling for advertising is covered by clause 24, which also explains your choices about it.

17.8 Accuracy and fairness. We design our automated tools to be accurate and fair, and we review them from time to time. If you think that an automated result about you is wrong, you may ask us to correct it, and we will look at the matter and tell you what we find.

17.9 Fraud screening. A fraud tool may flag an Order for review, but it does not by itself decide that you have committed fraud. A person looks at the facts before we cancel an Order or restrict an Account because of a flag.

17.10 Personalisation. We may personalise the content and offers that we show you, based on what you have bought and viewed. You may object to this through your cookie choices and your email settings, and you may write to us to ask us to stop.

18. Reviews, comments and testimonials

18.1 Public content. Comments and reviews that you post on the Website are public. Your name, your avatar and the text of what you write may be visible to anyone who visits the page.

18.2 What not to post. You should not post Sensitive Data, or the personal details of other people, in a comment or review. We may remove a post that contains them.

18.3 Testimonials. We publish a testimonial, with your name or likeness, only with your consent. You may withdraw your consent for future use at any time by writing to [email protected], although we cannot recall copies that have already been published or shared.

18.4 Moderation. We may review and moderate content before or after it is published. We use the Personal Data in a post to do this and to keep the Website safe.

18.5 Retention. We keep a comment, a review or a testimonial for as long as it is published, as clause 13 states. If you ask us to remove it, we will do so or anonymise it, subject to that clause.

18.6 Comment Cookies. If you choose to save your details for your next comment, a functional Cookie remembers them. Schedule 1 describes these Cookies.

18.7 Spam filtering. A spam-filtering service may receive your comment and your IP address, as a Processor, so that it can tell whether the comment is genuine.

18.8 Removing your content. If you ask us to remove content that you posted, we will remove it or anonymise it within the period in clause 13. Where the content has been quoted or shared by others, we cannot always remove those copies.

18.9 Photographs. If you send us a photograph for a testimonial, we use it only for that purpose and only with your consent. We do not publish photographs of other people without their consent.

19. Coaching and consulting services

19.1 Where this clause applies. Where we offer Coaching Services, this clause 19 explains how we handle Personal Data in connection with them. It applies in addition to the rest of this Privacy Policy.

19.2 Data we collect. We may collect the information that you give us in an intake form, your goals, the notes that we make about our sessions, scheduling data and, where we tell you beforehand, recordings of sessions. We collect this data from you directly.

19.3 Purposes. We use this data to plan and deliver the sessions, to give you the support that you ask for, to keep records and to deal with any question or claim that arises. We do not use it for advertising.

19.4 Confidentiality. We keep what you share with us confidential. We may disclose it only where the law requires, or where this is needed to protect a person from serious harm.

19.5 Recordings. We record a session only after we have told you, and we keep the recording for the period in clause 13. You may ask us not to record, and we will tell you if that affects the service.

19.6 Sensitive Data. Please share Sensitive Data with us only where it is needed and where you choose to do so. We use it only to deliver the session and for no other purpose.

19.7 Providers. The scheduling and video-conferencing providers that we use act as Processors on our instructions. Schedule 2 lists the categories of providers.

19.8 No regulated relationship. Coaching Services do not create a legal, medical, financial or other regulated professional relationship. The Terms of Use explain this, and nothing here changes it.

19.9 Your rights. You may ask to see the notes that we hold about you, or ask us to correct or delete them, by writing to [email protected]. Clause 15 explains how we deal with these requests and the limits that apply.

20. Affiliate and referral programme

20.1 Where this clause applies. Where we offer an affiliate programme, this clause 20 describes the Personal Data that we Process for it. It applies to Affiliate Partners and to people whom they refer.

20.2 Data about Affiliate Partners. We collect an Affiliate Partner’s name, contact details, tax and payout details, referral links and performance data, such as clicks and sales. We collect it from the Affiliate Partner and from the affiliate platform.

20.3 Data about referred visitors. When you click an affiliate link, a referral Cookie records which Affiliate Partner sent you, so that a later purchase can be attributed correctly. We do not give the Affiliate Partner your name or contact details unless you tell us that we may.

20.4 Purposes. We use this data to track referrals, to calculate and pay commission, to meet tax duties and to detect fraud and misuse of the programme. We rely on the performance of our contract with the Affiliate Partner and on our legal obligations.

20.5 Providers. The affiliate platform and the payout providers that we use act as Processors or as independent Controllers, as Schedule 2 describes. They handle payout and tax data under their own security measures.

20.6 Affiliate Partners’ duties. An Affiliate Partner must follow the privacy, marketing and consumer laws that apply to its promotion. It must not send us the Personal Data of people unless it has a lawful basis to do so.

20.7 Retention. We keep affiliate records and tax documents for the period in clause 13.

20.8 Your rights. An Affiliate Partner may ask to see, correct or delete its data by writing to [email protected], subject to our duty to keep tax and payout records. Referred visitors may use the rights in clause 15 and the cookie choices in clause 9.

21. Subscriptions and recurring billing

21.1 Where this clause applies. Where we offer Subscriptions, this clause 21 explains the Personal Data that we Process for recurring billing. It applies in addition to clause 5.

21.2 Renewal data. The Payment Processor holds your payment method in tokenised form so that it can charge each renewal. We receive the status of each payment and the renewal date, and we do not see your full card number.

21.3 Notices. We send renewal reminders and billing notices where the law requires them or where we think they are useful. These are service messages, and you cannot opt out of them while your Subscription is active.

21.4 Cancellations and failed payments. We keep a record of your cancellation requests and of failed payments, so that we can apply your choices and resolve any dispute. We use the records to decide when to suspend access for non-payment.

21.5 Retention. We keep Subscription and billing records for the periods in clause 13.

21.6 Changes of payment method. If you change your payment method, the Payment Processor updates the tokenised record. We receive only the status of the change, and we do not see your new card details.

22. Software, apps and telemetry

22.1 Where this clause applies. Where we offer Software or apps, this clause 22 describes the Personal Data that the Software and its related services Process. It applies in addition to the rest of this Privacy Policy.

22.2 Activation and checks. The Software may need to activate with a licence key and may check from time to time that your licence is valid. We use the data from these checks to enforce licences and to help you if something goes wrong, as clause 7 explains.

22.3 Diagnostic and crash data. The Software may send us diagnostic and crash data, such as error messages and the state of the Software when a problem occurred. We use this data to find and fix faults.

22.4 Usage telemetry. The Software may send us limited usage data, which we describe by category, such as which features are used and how often. Where the law requires your consent for this data, we ask for it first, and the data is optional in that case.

22.5 Version and device data. To deliver updates, the Software may send us its version and basic details of your device, such as the operating system. We use these details to offer you the correct update.

22.6 Your files. We do not collect the contents of your files through the Software. If you send us a file for support, we use it only to help you with the problem that you describe.

22.7 Disabling telemetry. Where the Software offers a setting to turn off telemetry, you may use it at any time. Turning it off does not stop the data that we need for licence checks.

22.8 Retention. We keep Software data for the periods in clause 13.

22.9 Updates and support. When you ask for support, we may need the version of the Software, details of your system and the steps that led to the problem. We use them only to help you and to improve the Software.

22.10 Third-party components. Some Software uses third-party components, which may collect data under their own terms. We choose components with care, and the Product Page or the documentation tells you where a component has settings that you can change.

22.11 Artificial intelligence features. Where the Software includes artificial intelligence features, clause 17 explains how your inputs are handled.

23. Users’ own data processed through Products

23.1 Where this clause applies. Where Products process data that you provide about others, this clause 23 explains who is responsible for that data. For example, a Product may process the details of your own customers or contacts.

23.2 You decide what to enter. You choose what data you enter into a Product, and you are the Controller of that data. We do not decide why or how you use it.

23.3 Our role as Processor. Where a Product processes your customer data on your behalf, we act as your Processor. We do so under a data processing agreement, which we will give you on request to [email protected].

23.4 Your responsibilities. You must have a lawful basis to use the data and to enter it into the Product. You must also tell your own Data Subjects how you use their Personal Data, as Applicable Data Protection Law requires.

23.5 Our use of the data. We do not use that data for our own purposes, except to provide the Product and to keep it secure. We do not sell it, and we do not use it for advertising.

23.6 Deletion. When your access ends, we delete the data that you entered into the Product, subject to the cycle of our backups, which clause 13 describes.

24. Analytics, advertising and retargeting

24.1 Analytics. We use Cookies and similar tools to measure traffic and to understand how the Website is used, so that we can improve it. Where the analytics tool offers it, we shorten or anonymise IP addresses before they are stored.

24.2 Advertising and retargeting. We use pixels and tags that allow advertising platforms to show our advertisements and to measure the results. This may involve sharing hashed identifiers and event data, such as a page view or a purchase, with those platforms.

24.3 “Sharing” and targeted advertising. Under some laws, these activities may be treated as “sharing” of Personal Data or as “targeted advertising”. Schedule 4 and Schedule 1 explain your choices in more detail.

24.4 Consent and opt-out routes. You can control these activities in several ways:

(a) through our cookie banner, where it is shown;

(b) through the cookie settings link in the footer of the Website;

(d) through the advertising settings of the platforms that you use; and

(e) through industry opt-out sites, which we describe here by type and do not list individually.

24.5 No sale for money. We do not sell Personal Data for money. We share data with advertising platforms only as this clause describes.

24.6 Custom and lookalike audiences. We create custom audiences or lookalike audiences, which use hashed customer data to find similar people, only with the consent that the law requires. If you do not consent, we do not include your data.

24.7 Retention. We keep analytics and advertising data for the periods in Schedule 1 and clause 13, and in any case for no longer than the maximum that those provisions state.

24.8 Advertising platforms’ role. The advertising platforms that we use may act as independent Controllers or joint Controllers of the data that they receive. Their own privacy policies explain how they use it, and you should read them.

24.9 What we learn. We use analytics to learn which pages people visit, how they reach the Website and which parts of it are hard to use. We use advertising data to learn whether our advertisements reach the people they are meant for and what happens after they click.

24.10 Combining data. Advertising platforms may combine the data that they receive from us with data that they already hold about you. We do not control that combination, and your choices in your account on the platform apply to it.

24.11 Withdrawing consent. If you have agreed to analytics or advertising Cookies, you may withdraw your agreement at any time through the cookie settings link. Withdrawing stops the further collection of that data but does not affect what was collected before.

25. Webinars and events

25.1 Where this clause applies. Where we offer webinars, live sessions or Events, this clause 25 describes the Personal Data that we Process for them. It applies in addition to the rest of this Privacy Policy.

25.2 Registration data. We collect your name and email address, the questions that you ask, your attendance and, for a paid Event, the payment details that the Payment Processor handles. We use them to run the Event and to send you its details.

25.3 Providers. A video-conferencing provider hosts the Event and acts as our Processor. It may collect technical data, such as your IP address and device details, under its own policy as well.

25.4 Recording. We may record an Event. If you speak or appear on camera, you will appear in the recording, and you may turn off your camera and microphone if you do not want to.

25.5 Replays. If we store a recording so that it can be replayed, we store it with a provider that acts as a Processor, and we keep it for the period in clause 13.

25.6 Names and questions. We share the name of an attendee, or the question that they asked, with other attendees or speakers only as the attendee permits. We do not publish attendee lists.

25.7 Follow-up emails. We may send follow-up emails about the Event, which are service messages. We send marketing emails only where clause 8 allows.

26. Website contact form

26.1 What we collect. If you use the contact form on the Website, we collect your name, your email address, the topic that you choose, your message and the tick box that shows that you have read this Privacy Policy. The form tool and any spam protection also record technical data when you send the form, such as your IP address, the date and time, browser information and spam signals.

26.2 Why we collect it. We use this data to read and answer your message, to provide support, to keep a record of what was said and to protect the Website from spam and abuse. We do not use it for marketing unless you ask us to.

26.3 Legal basis. Our legal basis is our legitimate interest in answering enquiries and running the Website. Where your message concerns an Order, an Account or a request that you made before buying, our basis is also the performance or preparation of a contract with you. Where the law requires your consent for a purpose, we ask for it separately, as clause 4 explains.

26.4 The tick box. The tick box confirms that you have read this Privacy Policy. It is not a request for your consent. You are not obliged to use the form, and you may write to [email protected] instead.

26.5 Where it goes. Messages are stored in the database of the Website and sent by email to our support mailbox. The hosting provider, the email provider and any spam-protection service act as Processors on our instructions, as clause 10 and Schedule 2 describe. The form is provided by the form tool on the Website.

26.6 How long we keep it. We keep general enquiries for twelve (12) months after the enquiry is closed. Where your message concerns an Order, an Account or a refund, we keep it for the longer periods in clause 13.

26.7 What not to send. Please do not send payment card details, passwords or Sensitive Data through the form. If you do, we use it only to respond to you.

26.8 Your rights. To access, correct or delete what you sent us, write to [email protected]. Clause 15 explains your rights and how we deal with requests.

27. Regional supplements

27.1 Supplements. This Privacy Policy has three regional supplements, which add rights and information for people in particular regions:

(a) Schedule 3 covers the European Economic Area, Switzerland and the United Kingdom;

(b) Schedule 4 covers the United States; and

27.2 Effect. A supplement applies to the extent that the relevant law applies to us. For a person whom a supplement covers, the supplement prevails over the main text of this Privacy Policy if the two differ.

27.3 Other regions. If you live in a region that these supplements do not name, you still have the rights in clause 15 that the law of your region gives you. You may write to [email protected] to use them.

27.4 Where you live. Which supplement applies to you depends on where you live when you use the Website or when we Process your data. If more than one applies, you may use the rights in each of them.

28. Changes to this Privacy Policy

28.1 Our right to update. We may update this Privacy Policy from time to time, for example to reflect changes in the law or in how we handle Personal Data. We post the updated version on the Website with a new “Last updated” date.

28.2 Notice of material changes. For a material change, we will tell you by email or by a prominent notice on the Website before the change takes effect. Where the law requires, we will ask for your fresh consent.

28.3 Earlier versions. You may ask us for earlier versions of this Privacy Policy by writing to [email protected]. We will send you the version that applied on a date that you name, where we still have it.

28.4 Please check from time to time. We suggest that you read this Privacy Policy from time to time, so that you know how we handle your Personal Data. A change does not reduce a right that you have under Applicable Data Protection Law.

28.5 Changes in how we use data. If we start to use Personal Data for a new purpose that is not compatible with those in this Privacy Policy, we will tell you before we do so. We will also give you the choices that the law requires.

28.6 Continued use. Using the Website after an update takes effect means that you have seen the updated Privacy Policy. It does not mean that you consent to anything that the law says needs your separate consent.

29. Contact, privacy requests and complaints

29.1 How to contact us. To exercise your rights or ask a question, contact us at [email protected]. We use this one address for every privacy matter, and we do not publish a postal address or a telephone number.

29.2 Complaints. If you have a complaint, please contact us first so that we can try to resolve it. You may also complain to the Regulator in your country, and the regional supplements in Schedules 3, 4 and 5 name the Regulators for the regions that they cover.

29.3 Response times. We respond to requests within the times that clause 15 sets. We will tell you if we need more time and why.

29.4 Useful details. To help us find your records, please give the email address that you used for your Account or Orders and a short description of your request. Please do not include payment card numbers or passwords.

29.5 Our Website. Our Website is https://quillandcrest.com. This Privacy Policy was last updated on 21 October 2026.

29.6 Privacy requests from others. If you write on behalf of another person, please tell us who you are and send the written authority that clause 15 requires. We may need to confirm the identity of the person whom you represent.

29.7 Regulators. A Regulator may ask us to take part in the handling of a complaint. We will cooperate with the Regulator and give it the information that the law requires.

29.8 Keeping a record. We keep a record of each request and complaint, and of how we dealt with it. We use the record to show that we follow the law and to improve our practices.

Schedule 1: Cookie policy

This Schedule is our cookie policy. Cookies are small text files stored on your device; similar technologies include pixels, local storage and device identifiers. Strictly necessary cookies do not need your consent. For all other cookies we ask for your consent through our cookie banner, where Applicable Data Protection Law requires it, and you can change your choice at any time through the cookie settings link in the footer of the Website or through your browser. We honour the Global Privacy Control signal as an opt-out of sale, sharing and targeted advertising where Applicable Data Protection Law requires it. Blocking some cookies may affect how the Website works. The table lists the types of cookies we use; the exact cookies depend on the tools in use at the time.

Name or type	Provider and purpose	Category	Duration	First or third party
Session and login cookies	Our website platform or learning platform. Keep you logged in and identify your session	Strictly necessary	Session to 14 days	First party
Security and form-protection tokens	Our website platform. Protect forms and Accounts against forgery and abuse	Strictly necessary	Session	First party
Checkout and cart cookies	The Payment Processor. Support checkout and fraud prevention	Strictly necessary	Session to 12 months	Third party
Cookie consent record	Our consent tool. Remembers your cookie choices	Strictly necessary	Up to 12 months	First party
Preference cookies	Our website platform. Remember language, region and display settings	Functional	Up to 12 months	First party
Comment cookies	Our website platform. Remember your name, email address and website for your next comment, if you opt in	Functional	Up to 12 months	First party
Analytics cookies	Our analytics provider. Measure visits, pages viewed and traffic sources	Analytics	Up to 25 months	First or third party
Video player cookies	Our video host. Play and measure embedded video	Functional or analytics	Up to 12 months	Third party
Advertising pixels and cookies	Our advertising platforms. Measure conversions and enable retargeting	Marketing	Up to 12 months	Third party
Affiliate referral cookie	Our affiliate platform or Payment Processor. Attributes a purchase to the referring Affiliate Partner	Marketing	Up to 90 days	First or third party
Email tracking pixels	Our email service provider. Record whether an email was opened and which links were clicked	Analytics or marketing	Not applicable	Third party

S1.1 Managing Cookies through the Website. You can accept, refuse or change your choice about non-essential Cookies through our cookie banner, where it is shown. You can change your choice at any time through the cookie settings link in the footer of the Website, and your new choice applies from that moment.

S1.2 Managing Cookies through your browser. Most browsers let you see, block and delete Cookies. The steps differ from one browser to another, so please look in the help section of your browser for instructions. If you block all Cookies, including strictly necessary Cookies, some parts of the Website, such as login and checkout, may not work.

S1.3 Do Not Track and Global Privacy Control. Some browsers send a “Do Not Track” signal. Not all browsers or websites support it, and we do not treat it as a choice about Cookies. We do treat the Global Privacy Control signal as an opt-out of sale, sharing and targeted advertising, where Applicable Data Protection Law requires us to.

S1.4 Local storage and device identifiers in apps. Where we offer Software or apps, they may use local storage and device identifiers instead of Cookies, for example to remember your settings or to check your licence. We treat them in the same way as Cookies, and where an app offers a setting to limit them, you may use it.

S1.5 Email tracking. Our emails may contain tracking pixels that record whether you open a message and which links you click. Clause 8 explains how you can limit this.

S1.6 Analytics and advertising. Clause 24 explains how we use analytics and advertising tools and the choices that you have about them. Clause 9 summarises the categories of Cookies that we use.

S1.7 Fonts. Clause 11 explains how the fonts on our Website are loaded and what data this involves.

S1.8 Changes to the list. The Cookies that we use depend on the tools in use at the time, and the tools may change. We update this Schedule when the types of Cookies that we use change, and we will ask for your consent again where the law requires it for a new type.

S1.9 Third-party Cookies. Some Cookies come from third parties, such as the Payment Processor, a video host or an advertising platform. We do not control them, and the privacy policy of each provider explains how it uses the data that its Cookies collect.

S1.10 Questions. If you have a question about the Cookies that we use, please write to [email protected]. We will tell you which Cookies the Website is using when you ask.

Schedule 2: Register of main service providers

The table lists the categories of providers we use, with examples of well-known providers in each category. The examples show the kind of provider; the providers we actually use at any time may differ, and we will give you the names of the current providers on request to [email protected].

Provider category	Examples	Role	Personal Data shared	Typical location	Transfer safeguard
Payment and merchant of record	Paddle, Lemon Squeezy, FastSpring	Independent Controller or Processor	Identity, contact, order, billing country, transaction data	United States, the EEA, the United Kingdom, or another country where the provider operates	Adequacy decision, standard contractual clauses or an equivalent mechanism, as applicable
Website hosting and database	WP Engine, Kinsta, SiteGround	Processor	Account, order, usage and log data	United States, the EEA, the United Kingdom, or another country where the provider operates	Adequacy decision, standard contractual clauses or an equivalent mechanism, as applicable
File storage and delivery	Amazon Web Services, Cloudflare, Bunny	Processor	Product files, access and download data	United States, the EEA, the United Kingdom, or another country where the provider operates	Adequacy decision, standard contractual clauses or an equivalent mechanism, as applicable
Course or learning platform	Teachable, Thinkific, Kajabi	Processor or Controller	Account, enrolment, progress and video data	United States, the EEA, the United Kingdom, or another country where the provider operates	Adequacy decision, standard contractual clauses or an equivalent mechanism, as applicable
Email marketing and customer relationship management	Mailchimp, MailerLite, Kit (formerly ConvertKit)	Processor	Name, email, preferences, email interaction data	United States, the EEA, the United Kingdom, or another country where the provider operates	Adequacy decision, standard contractual clauses or an equivalent mechanism, as applicable
Help desk and customer support	Zendesk, Freshdesk, Help Scout	Processor	Contact data, support messages	United States, the EEA, the United Kingdom, or another country where the provider operates	Adequacy decision, standard contractual clauses or an equivalent mechanism, as applicable
Analytics	Google Analytics, Plausible, Matomo	Processor or Controller	Device, usage and cookie data	United States, the EEA, the United Kingdom, or another country where the provider operates	Adequacy decision, standard contractual clauses or an equivalent mechanism, as applicable
Advertising and measurement	Meta, Google Ads, TikTok	Controller or joint Controller	Device, usage, hashed identifiers, conversion events	United States, the EEA, the United Kingdom, or another country where the provider operates	Adequacy decision, standard contractual clauses or an equivalent mechanism, as applicable
Video hosting and streaming	Vimeo, Wistia, Bunny Stream	Processor or Controller	Playback and device data	United States, the EEA, the United Kingdom, or another country where the provider operates	Adequacy decision, standard contractual clauses or an equivalent mechanism, as applicable
Scheduling and video conferencing	Calendly, Zoom, Google Meet	Processor	Name, email, session data, recordings	United States, the EEA, the United Kingdom, or another country where the provider operates	Adequacy decision, standard contractual clauses or an equivalent mechanism, as applicable
Affiliate platform and payouts	Rewardful, FirstPromoter, the built-in tool of the Payment Processor	Processor or Controller	Affiliate and payout data, referral attribution	United States, the EEA, the United Kingdom, or another country where the provider operates	Adequacy decision, standard contractual clauses or an equivalent mechanism, as applicable
Code repository and software delivery	GitHub, GitLab	Independent Controller	Username, email, access status	United States, the EEA, the United Kingdom, or another country where the provider operates	Adequacy decision, standard contractual clauses or an equivalent mechanism, as applicable
Artificial-intelligence services	OpenAI, Anthropic, Google	Processor	Prompts, inputs and transcripts as submitted by users	United States, the EEA, the United Kingdom, or another country where the provider operates	Adequacy decision, standard contractual clauses or an equivalent mechanism, as applicable
Fraud prevention and identity verification	The Payment Processor’s own tools	Processor or Controller	Identity, device, IP, order data	United States, the EEA, the United Kingdom, or another country where the provider operates	Adequacy decision, standard contractual clauses or an equivalent mechanism, as applicable
Accounting and tax	Xero, QuickBooks, FreshBooks	Processor or Controller	Transaction and invoice data	United States, the EEA, the United Kingdom, or another country where the provider operates	Adequacy decision, standard contractual clauses or an equivalent mechanism, as applicable
Fonts and content delivery	Google Fonts, or fonts hosted on our own server	Processor or Controller	IP address and device information (only if fonts are loaded from a third party; see clause 11)	United States, the EEA, the United Kingdom, or another country where the provider operates	Adequacy decision, standard contractual clauses or an equivalent mechanism, as applicable

Schedule 3: Regional supplement A: European Economic Area, Switzerland and the United Kingdom

S3.1 Application. This supplement applies to you if you are in the European Economic Area, Switzerland or the United Kingdom, and it applies to the extent that the relevant law applies to us. It adds to the rest of this Privacy Policy, and if the two differ for you, this supplement prevails.

S3.2 Controller and representative. Quill and Crest is the Controller of your Personal Data. We have appointed a person responsible for data protection matters, who can be contacted at [email protected]. Where Applicable Data Protection Law requires us to appoint a representative in the European Economic Area or the United Kingdom, we will do so and publish the contact details here.

S3.3 Legal bases. The table in clause 4 sets out the purposes of our Processing and the legal basis for each. Where we rely on legitimate interests, you may ask us for a summary of how we balanced our interests against your rights, and we will give it to you on request to [email protected].

S3.4 Your rights. Under the European Union General Data Protection Regulation, the United Kingdom General Data Protection Regulation and Swiss law, you have the following rights, subject to the conditions that the law sets:

(a) the right of access to your Personal Data;

(b) the right to have inaccurate Personal Data corrected;

(d) the right to restrict our Processing of it;

(e) the right to receive your Personal Data in a portable format;

(f) the right to object to Processing that is based on our legitimate interests or that is for direct marketing;

(g) the right to withdraw your consent at any time; and

(h) the right not to be subject to a decision based solely on automated Processing that has legal or similarly significant effects.

S3.5 Time to respond. We respond to your request within one (1) month. Where a request is complex or you make several requests, we may extend this period by up to two (2) further months, and we will tell you of the extension and the reasons for it within the first month.

S3.6 Marketing and Cookies. We ask for your consent to set non-essential Cookies, as the electronic privacy rules of the European Union and the Privacy and Electronic Communications Regulations in the United Kingdom require. Where the law allows, we may send marketing emails about similar products to existing customers on the basis of the soft opt-in, and you may opt out at any time.

S3.7 International transfers. When we transfer your Personal Data outside the European Economic Area, Switzerland or the United Kingdom, we use a mechanism that the law recognises. These include adequacy decisions, the standard contractual clauses, the United Kingdom International Data Transfer Agreement or Addendum and the Swiss addendum, as clause 12 explains. You may ask us for a copy of the safeguards at [email protected].

S3.8 Complaints. You may complain to the supervisory authority of the country in which you live, in which you work or in which the alleged infringement took place. In the United Kingdom, this is the Information Commissioner’s Office. In Switzerland, it is the Federal Data Protection and Information Commissioner. We would welcome the chance to deal with your concern first.

S3.9 Children. Our Website and Products are for people aged eighteen (18) or over, so the lower ages at which digital consent applies in different countries do not affect our Processing. Clause 16 explains how we treat Products that are designed for children.

S3.10 Retention. We keep Personal Data for the periods in clause 13. Where national rules require a longer period, those rules apply to the records that they cover.

S3.11 Provision of data. Where we need Personal Data to enter into or to perform a contract with you, we tell you at the time. If you do not provide it, we may not be able to supply the Product that you ordered.

Schedule 4: Regional supplement B: United States

S4.1 Application. This supplement applies to you if you live in the United States, including California, Colorado, Connecticut, Virginia, Utah, Texas and Oregon and other states that have comprehensive privacy laws, and it applies to the extent that the relevant law applies to us. If the supplement differs from the main text of this Privacy Policy for you, the supplement prevails.

S4.2 Categories of Personal Data. The following table lists the categories of Personal Data that we have collected and disclosed in the past twelve (12) months. It also shows whether we sell or share each category. “Share” has the meaning that the relevant state law gives it.

Category	Examples	Collected	Disclosed for a business purpose	Sold or shared
Identifiers	Name, email address, IP address, device and advertising identifiers	Yes	Yes	Shared for cross-context behavioural advertising only if you accept advertising cookies
Customer records and commercial information	Order history, billing country, support messages	Yes	Yes	No
Internet or network activity	Pages viewed, links clicked, browsing on the Website, interaction with emails	Yes	Yes	Shared for cross-context behavioural advertising only if you accept advertising cookies
Geolocation (approximate, from IP address)	Country, region and city derived from your IP address	Yes	Yes	Shared for cross-context behavioural advertising only if you accept advertising cookies
Audio, visual or similar information	Recordings of live sessions, photographs supplied for testimonials	Yes, where you take part	Yes	No
Professional or employment information	Job title or business details that you give us	Yes, where provided	Yes	No
Education information	Enrolment, progress and completion data	Yes	Yes	No
Inferences	Segments and interests drawn from your purchases and activity	Yes	Yes	Shared for cross-context behavioural advertising only if you accept advertising cookies
Sensitive personal information	Account login credentials, held in hashed form	Yes	Yes	No

S4.3 No sale for money; sharing. We do not sell Personal Data for money. Advertising cookies and pixels may count as “sharing” or as “targeted advertising” under some state laws. You may opt out through the cookie settings link in the footer of the Website, through the Global Privacy Control signal, or by writing to [email protected].

S4.4 Your rights. Depending on the law of your state, you may have the following rights:

(a) to know and to access the Personal Data that we hold about you;

(b) to delete your Personal Data;

(d) to receive your Personal Data in a portable format;

(e) to opt out of the sale or sharing of your Personal Data, of targeted advertising and of profiling;

(f) to limit our use of your sensitive personal information; and

(g) not to be treated unfairly because you use your rights.

If we refuse your request, you may appeal within a reasonable time, and where state law gives you the right to an appeal, we will respond within sixty (60) days.

S4.5 How to make and verify a request. You may make a request by writing to [email protected]. We verify your identity by matching the information that you give us with the information that we already hold, and we may ask for more where this is needed. An authorised agent may make a request for you with your written permission, and we may ask you to confirm it directly. We respond within forty-five (45) days, and we may extend this period by a further forty-five (45) days after we tell you why.

S4.6 California “Shine the Light”. California residents may ask us once a year for details of the Personal Data that we have disclosed to third parties for their direct marketing purposes. We do not disclose Personal Data to third parties for their own direct marketing.

S4.7 Do Not Track. We do not respond to the “Do Not Track” signals that browsers send, except that we treat the Global Privacy Control as an opt-out signal, as clause 9 explains.

S4.8 Financial incentives. We do not offer financial incentives for your Personal Data. If we ever do, we will tell you in a separate notice that explains the terms.

S4.9 Minors. Our Website and Products are not directed to people under eighteen (18). We do not knowingly sell or share the Personal Data of anyone under sixteen (16).

S4.10 Retention. We keep Personal Data for the periods in clause 13.

S4.11 Notice at collection. This Privacy Policy and Schedule 1 are our notice at collection. They tell you the categories of Personal Data that we collect, the purposes for which we use them and how long we keep them.

S4.12 Contact. For questions about this supplement, write to [email protected]. We do not publish a telephone number or a postal address.

Schedule 5: Regional supplement C: Nigeria, Canada, Australia, Brazil and South Africa

To the extent that the law of each country below applies to us, the following applies to people in that country. The rest of this Privacy Policy applies as well, and where the two differ, this supplement prevails for those people.

S5.1 Nigeria.

(a) Law. The Nigeria Data Protection Act 2023 applies to our Processing of your Personal Data, to the extent that it applies to us.

(b) Lawful bases. We Process your Personal Data on the lawful bases in clause 4, such as the performance of a contract, a legal obligation, our legitimate interests and your consent.

(c) Your rights. You have the right to be informed about our Processing and to access, correct and erase your Personal Data. You may also restrict or object to our Processing, receive your data in a portable format, withdraw your consent and not be subject to a decision based solely on automated Processing.

(d) Cross-border transfers. We transfer your Personal Data outside Nigeria only where it will be adequately protected or where another safeguard that the law allows applies, as clause 12 explains.

(e) Breaches. Where the law requires, we will notify the Nigeria Data Protection Commission of a breach within seventy-two (72) hours of becoming aware of it, and we will tell the people affected where the law requires.

(f) Complaints. You may complain to the Nigeria Data Protection Commission. We would welcome the chance to deal with your concern first.

S5.2 Canada.

(a) Law. The Personal Information Protection and Electronic Documents Act, and the provincial laws that apply, including Quebec’s Law 25, apply to our Processing.

(b) Consent and purposes. We collect, use and disclose your Personal Data for the purposes in this Privacy Policy, and we obtain your consent where the law requires it. You may withdraw your consent, subject to legal and contractual limits, and we will tell you what that means for the service.

(c) Access and correction. You may ask us for access to your Personal Data and for its correction by writing to [email protected].

(d) Quebec. Our privacy contact is [email protected]. We assess the privacy risks of transfers outside Quebec, and where the law provides, you have the right to data portability and to ask that information about you be de-indexed.

(e) Complaints. You may complain to the Office of the Privacy Commissioner of Canada or to the privacy authority of your province.

(f) Commercial email. We send commercial email only with the consent that Canada’s anti-spam law requires, and every message has an unsubscribe mechanism.

S5.3 Australia.

(a) Law. The Privacy Act 1988 and the Australian Privacy Principles apply to our Processing, to the extent that they apply to us.

(b) Access and correction. You may ask us to give you access to your Personal Data and to correct it, by writing to [email protected]. We will respond within a reasonable time and tell you if we cannot give you access, and why.

(c) Overseas recipients. We may disclose Personal Data to recipients outside Australia. Before we do so, we take the steps that Australian Privacy Principle 8 requires to make sure that the recipient protects your Personal Data.

(d) Complaints. Please complain to us first, at [email protected]. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner.

(e) Commercial email. We comply with the Spam Act when we send commercial email, and every message has an unsubscribe mechanism.

S5.4 Brazil.

(a) Law. The Lei Geral de Proteção de Dados applies to our Processing, to the extent that it applies to us.

(b) Legal bases. We Process your Personal Data on the legal bases that the law recognises, including your consent, the performance of a contract, a legal obligation and our legitimate interest, as clause 4 explains.

(c) Your rights. Under article 18, you have the right to confirmation that we Process your data, to access it and to correct it. You may ask for anonymisation, blocking or deletion of unnecessary or excessive data, and for portability. You may also ask for information about the entities with which we share your data, about the consequences of refusing consent and for review of automated decisions, and you may withdraw your consent.

(d) Our data protection contact. The person responsible for data protection matters, known as the “encarregado”, can be reached at [email protected].

(e) International transfers. We transfer your Personal Data internationally only by the mechanisms that the law provides, as clause 12 describes.

(f) Response time. Where the law sets a period for a complete declaration, we give it within fifteen (15) days of your request.

(g) Complaints. You may complain to the Autoridade Nacional de Proteção de Dados.

S5.5 South Africa.

(a) Law. The Protection of Personal Information Act applies to our Processing, to the extent that it applies to us. We are the responsible party for your Personal Data.

(b) Lawful processing. We Process your Personal Data in line with the conditions for lawful processing that the Act sets, including accountability, purpose specification, limits on further processing and security safeguards.

(c) Your rights. You have the right to ask for access to your Personal Data, to have it corrected or deleted and to object to our Processing. You may also withdraw your consent and object to direct marketing.

(d) Cross-border transfers. We transfer your Personal Data outside South Africa only where the law allows.

(e) Information officer. Our information officer can be reached at [email protected].

(f) Complaints. You may complain to the Information Regulator.