CTO Academy Privacy Policy

1. Who we are

CTO Academy Limited is the controller responsible for the personal information described in this Privacy Policy.

2. Information we collect

The information we collect depends on how you interact with CTO Academy. It may include:

• Identity and contact information, such as your name, email address, telephone number, postal address and country.
• Professional information, such as your job title, employer, professional interests, seniority and career or development goals.
• Account and order information, such as your username, programme enrolment, order history, account status and access records.
• Payment and transaction information, such as payment status, transaction reference, billing details and records needed for accounting. Full payment-card details are normally collected and processed directly by our payment providers rather than stored by CTO Academy.
• Programme and community information, such as progress, assessment responses, attendance, participation, feedback, support requests, certificates and communications connected with your learning experience.
• Marketing and communication information, such as your communication preferences, form submissions, enquiries, email engagement and interactions with our content.
• Technical and usage information, such as your IP address, browser type, device information, pages viewed, login activity, referral source and cookie or analytics identifiers.
• Content you provide, such as messages, survey responses, testimonials, event contributions or other material you choose to submit.

We do not ask you to provide special category information unless it is genuinely necessary for a particular purpose and we have an appropriate lawful basis for using it.

3. How we collect information

We collect personal information:

• directly from you when you create an account, place an order, complete a form, download a resource, contact us, participate in a programme or event, or communicate with our team;
• automatically when you use our website, learning platform, emails and other digital services, subject to your cookie and communication choices;
• from an employer or organisation that purchases access or enrols you in a CTO Academy programme;
• from payment providers and other service providers involved in completing a transaction or delivering our services; and
• where lawful and appropriate, from trusted partners, referrals or publicly available professional sources.

Where another organisation provides your information to us, that organisation is responsible for ensuring that it has an appropriate basis for doing so. We will provide relevant privacy information to you as required by law.

4. How and why we use information

We only use personal information when we have a lawful basis for doing so. Depending on the activity, we may rely on performance of a contract, steps taken before entering a contract, compliance with a legal obligation, our legitimate interests or your consent.

Our legitimate interests include operating and improving CTO Academy, supporting customers and participants, protecting our systems, understanding the effectiveness of our services and communicating relevant information about our programmes. We consider the impact on your rights before relying on legitimate interests.

Automation and profiling

We may use limited automation or profiling to organise contacts, understand engagement and tailor communications based on information such as the resources you request, the programmes you enquire about and your interactions with our emails or website.

We do not currently use solely automated decision-making that produces legal effects, or similarly significant effects, for individuals. If this changes, we will provide the information required by law.

5. Marketing communications

When you sign up to a newsletter, download a resource, enquire about a programme or otherwise request information, we may collect details including your name, email address, job title, organisation and telephone number.

We may use this information to send CTO Academy news, resources, event information and relevant programme communications. Depending on the circumstances, we rely on your consent or on our legitimate interests where marketing is permitted by applicable law, including the rules governing electronic communications.

We may use email automation to send communications based on your stated interests or your interactions with our content. For example, if you enquire about a particular programme, we may send a short series of emails explaining its features, outcomes or next steps.

You can withdraw consent or object to direct marketing at any time by:

• using the unsubscribe link included in our marketing emails;
• adjusting any communication preferences made available to you; or
• emailing [email protected].

Unsubscribing from marketing will not prevent us from sending essential service messages about an order, account, programme, event or other active relationship with you.

6. Cookies and website technologies

Our website uses cookies and similar technologies to operate essential features, remember preferences, understand website performance and, where you agree, support analytics and marketing.

We will not place non-essential cookies unless you have provided the required permission. You can review or change your choices using the cookie settings tool on our website and can also control cookies through your browser settings.

Blocking some cookies may affect features such as login, checkout, programme access, embedded content or saved preferences.

7. How we share information

We do not sell your personal information. We may share it where necessary with:

• employees, contractors and authorised team members who need access to perform their roles;
• website hosting, learning-platform, customer relationship management, email, analytics, customer-support, video-conferencing and other technology providers;
• payment processors, banks, accounting providers and fraud-prevention services;
• programme facilitators, lecturers, coaches, event partners, awarding or accrediting organisations where relevant to the service;
• an employer or organisation that purchased or manages your programme participation, where appropriate and consistent with the relevant arrangement;
• professional advisers, insurers, auditors, regulators, law-enforcement bodies, courts or other authorities where required or permitted by law; and
• a buyer, investor or successor organisation in connection with a genuine corporate transaction, subject to appropriate confidentiality and data-protection safeguards.

Service providers acting on our behalf may only use personal information in accordance with our instructions and their contractual and legal obligations.

8. International transfers

CTO Academy works with participants, organisations and service providers internationally. This means that personal information may be processed outside the United Kingdom.

Where information is transferred to a country that is not covered by UK adequacy regulations, we use an appropriate safeguard or another lawful transfer mechanism where required. This may include the UK International Data Transfer Agreement, the UK Addendum to approved contractual clauses or another safeguard recognised by UK data protection law.

You may contact us to request further information about the safeguards used for a particular transfer.

9. How long we keep information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including to provide services, maintain appropriate business records and meet legal, accounting, tax, regulatory or reporting requirements.

When deciding how long to retain information, we consider:

• the nature and sensitivity of the information;
• the duration of your account, programme, community access or customer relationship;
• the reason we collected the information and whether that purpose remains active;
• applicable limitation periods and legal record-keeping requirements;
• security, fraud-prevention and dispute-resolution needs; and
• whether the information can be anonymised instead of retained in identifiable form.

Marketing information is retained while you remain subscribed or while we have another lawful reason to keep it. We review engagement and may suppress or remove inactive contacts. A minimal suppression record may be retained so that we can respect an unsubscribe request.

10. How we protect information

We use appropriate organisational and technical measures designed to protect personal information against accidental or unlawful loss, alteration, disclosure, access or misuse.

These measures may include access controls, authentication, secure service providers, backups, monitoring, staff procedures and contractual confidentiality obligations. No website or electronic system can be guaranteed to be completely secure, but we review our safeguards and respond to suspected incidents in accordance with applicable law.

11. Your data protection rights

Depending on the circumstances and the lawful basis used, you may have the right to:

• ask for access to the personal information we hold about you;
• ask us to correct inaccurate or incomplete information;
• ask us to erase personal information in certain circumstances;
• ask us to restrict how personal information is used in certain circumstances;
• receive certain information in a portable format or ask us to transfer it to another organisation;
• object to processing based on legitimate interests and object at any time to direct marketing;
• withdraw consent at any time where we rely on consent; and
• raise concerns about significant decisions made solely by automated means, where applicable.

To exercise a right, email [email protected] and explain what you would like us to do.

You have an absolute right to object to the use of your personal information for direct marketing.

12. Complaints and contact details

If you have a concern about how we use personal information, please contact us first so that we can investigate and try to resolve it.

You can make a data protection complaint by emailing [email protected]. Please include enough information for us to understand the issue and contact you about it.

We will acknowledge a data protection complaint within 30 days, take appropriate steps to investigate it without undue delay, keep you informed where appropriate and communicate the outcome.

If you remain dissatisfied, you have the right to complain to the Information Commissioner’s Office:

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our services, systems, business practices or legal obligations.

The latest version will be published on this page with the date of the most recent update. Where a change is material, we will take reasonable steps to bring it to the attention of affected individuals before the new use of their personal information begins, where required.

Questions or comments about this Privacy Policy can be sent to [email protected].