Privacy Policy

Wells Media & Technology Academy Ltd ("Wells Tech Academy", "we", "us", "our") is committed to protecting your privacy and handling personal data lawfully, fairly, and transparently.

This Privacy Policy explains how we collect and use personal information when you visit our website, submit an enquiry or application, communicate with us, enrol on a programme, use My Academy (our learner platform), verify a certificate, or otherwise interact with Wells Tech Academy.

This policy is provided in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Data (Use and Access) Act 2025.

Wells Media & Technology Academy Ltd is the data controller for the personal information described in this policy.

Registered address: Wells Tech Academy, Croydon & Gloucester, United Kingdom.

Data protection and privacy enquiries: admin@wellstechacademy.co.uk

General enquiries: enquiry@wellstechacademy.co.uk

Telephone: 01452 340508

We have not appointed a statutory Data Protection Officer. Privacy matters are handled by our admissions and operations team, who escalate to senior management where required.

This policy applies to prospective learners, applicants, enrolled learners, alumni, employers or partners making enquiries, certificate verifiers, website visitors, and individuals who contact us by email, telephone, or through our online forms.

If you access My Academy or other authenticated services, additional information may be processed to deliver those services. This policy covers that processing unless a more specific notice is provided at the point of collection.

The information we collect depends on how you interact with us. We may collect the following categories of personal data:

• Identity and contact details — name, email address, telephone number, city, country, and similar contact information.
• Application and admissions information — programme preferences, delivery mode, location preferences, education background, experience level, career objectives, statement of interest, working arrangements, laptop access, and related admissions notes.
• Enrolment and academic records — cohort details, attendance, assignments, assessments, mentorship notes, certificates, and progression records for enrolled learners.
• Communications — emails, messages, call notes, and support correspondence.
• Financial information — payment plan details, payment records, and receipts where applicable. We do not store full payment card numbers on our systems.
• Account and authentication data — login credentials and session information for My Academy and internal systems, processed through our authentication provider.
• Technical and usage data — IP address, browser type, device information, pages viewed, referral source, and similar log data when you use our website or platforms.
• Consent and marketing preferences — records of consents you give or withdraw, including marketing opt-ins.
• Safeguarding and welfare information — only where relevant and necessary for learner welfare or legal obligations.

We collect personal information when you submit forms on our website, apply for a programme, contact us, enrol as a learner, use My Academy, respond to our communications, or interact with our admissions process.

We may also receive information from staff, mentors, or partners involved in delivery, and from service providers that support our operations (for example, email delivery or hosting providers), always in accordance with data protection law.

Some technical information is collected automatically through cookies, server logs, and similar technologies when you use our website. See our Cookie Policy for further details.

We use personal information for the following purposes:

• To respond to enquiries and communicate with prospective learners.
• To assess, process, and manage programme applications and admissions decisions.
• To enrol learners, deliver programmes, provide instruction, mentorship, and academic support.
• To operate My Academy and related learner services, including assignments, certificates, and communications.
• To manage payments, instalment plans, and financial administration.
• To send service communications about applications, enrolment, timetables, assessments, and operational matters.
• To send marketing communications about programmes and events where you have opted in.
• To deliver programme teaser and onboarding email series where you have applied or consented.
• To verify certificates and respond to verification requests from third parties.
• To maintain institutional records, quality assurance, reporting, and regulatory compliance.
• To improve our website, services, and learner experience.
• To protect the security and integrity of our systems and prevent fraud or misuse.
• To establish, exercise, or defend legal claims.

Under UK GDPR, we must have a lawful basis for processing personal data. Depending on the context, we rely on one or more of the following:

• Contract — processing necessary to take steps at your request before entering a contract, or to perform a contract with you (for example, processing your application or delivering an enrolled programme).
• Legitimate interests — processing necessary for our legitimate interests in operating a professional education institution, managing admissions, securing our systems, and improving our services, where those interests are not overridden by your rights.
• Consent — where you have given clear consent, for example for optional marketing communications or non-essential cookies.
• Legal obligation — where processing is necessary to comply with applicable law, regulation, or court order.
• Vital interests — in rare cases where processing is necessary to protect someone's life.

We do not routinely seek special category data (such as health information) through our public application forms.

If you voluntarily provide sensitive information, or if such information becomes relevant to reasonable adjustments, safeguarding, or welfare support, we will process it only where permitted by law — typically with your explicit consent, for substantial public interest reasons relating to safeguarding, or where necessary for the establishment or defence of legal claims.

We do not routinely process criminal offence data unless required for safeguarding, regulatory compliance, or legal proceedings.

We may send you information about programmes, events, and opportunities where you have opted in to marketing updates or where you have applied and we believe programme-related communications are relevant to your enquiry.

You can withdraw marketing consent at any time by using the unsubscribe link in our emails or by contacting us at the address above. Withdrawing marketing consent does not affect processing necessary for applications, enrolment, or service communications.

We do not sell your personal information. We may share personal data with trusted service providers and partners as described below. All processors act on our instructions and under appropriate contractual safeguards.

• Service providers who process data on our behalf under written agreements — including hosting and database providers (such as Supabase), email delivery providers (such as Resend), and website hosting providers (such as Vercel).
• Professional advisers — lawyers, accountants, or insurers where reasonably necessary.
• Regulators, courts, or law enforcement where required by law or to protect rights and safety.
• Awarding, accreditation, or partner organisations where necessary for programme delivery or verification — only with appropriate safeguards.

Some of our service providers may process personal data outside the United Kingdom. Where this occurs, we ensure appropriate safeguards are in place, such as UK adequacy regulations, the UK International Data Transfer Agreement, or equivalent approved mechanisms.

You may contact us for further information about transfers relevant to your data.

We retain personal information only for as long as necessary for the purposes described in this policy, including to manage applications, deliver programmes, meet legal and regulatory requirements, resolve disputes, and maintain accurate institutional records.

Application records are typically retained for a reasonable period to manage admissions and institutional reporting. Enrolled learner records are retained for the duration of study and for a defined period afterwards for certification, verification, and regulatory purposes.

Marketing consent records are retained while relevant and for a reasonable period after withdrawal to demonstrate compliance.

Technical logs are retained for limited periods appropriate to security and operational needs.

We implement appropriate technical and organisational measures to protect personal information against unauthorised access, loss, misuse, or alteration. These include access controls, authentication, encryption in transit, and staff confidentiality obligations.

No method of transmission or storage is completely secure. If you believe your interaction with us is no longer secure, please contact us promptly.

Under UK data protection law, you may have the following rights, subject to certain exemptions:

• Right of access — to obtain a copy of your personal data.
• Right to rectification — to correct inaccurate or incomplete data.
• Right to erasure — to request deletion in certain circumstances.
• Right to restrict processing — in certain circumstances.
• Right to object — to processing based on legitimate interests or for direct marketing.
• Right to data portability — for data you provided, where processing is based on consent or contract and carried out by automated means.
• Rights related to automated decision-making — we do not make solely automated decisions with legal or similarly significant effects in our admissions process.

To exercise your rights, email us at the contact address above with sufficient information to identify you and describe your request. We may need to verify your identity before responding.

We aim to respond within one month. This may be extended by up to two further months for complex requests, in which case we will inform you.

If you are concerned about how we handle your personal data, you have the right to complain to us directly before contacting the regulator.

Please email admin@wellstechacademy.co.uk with the subject line "Data protection complaint". Tell us what happened, which data is involved, and what outcome you are seeking.

We will acknowledge your complaint within 30 days of receipt and investigate without undue delay. We will keep you informed of progress and tell you the outcome once our investigation is complete.

If you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Website: https://ico.org.uk

Telephone: 0303 123 1113

Our programmes are designed primarily for adults. Our website and application forms are not directed at children under 16.

If you believe we have collected personal information from a child without appropriate authority, please contact us and we will take appropriate steps to delete it.

Our website uses cookies and similar technologies. Essential cookies are required for security, authentication, and core functionality. Further information, including how to manage preferences, is set out in our Cookie Policy.

Our website may contain links to third-party websites. We are not responsible for the privacy practices of those sites. We encourage you to read their privacy policies before providing personal information.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. Material changes will be published on this page with an updated date.

Where required, we will notify you of significant changes through appropriate channels.