PRE-LAUNCH DRAFT — NOT EXTERNALLY APPROVED. Public sales and waitlist collection are disabled. Replace all bracketed facts and verify each processor before collecting customer data.

Privacy notice

Who is responsible

Proposed data controller and seller: [PRIVACY CONTROLLER IDENTITY - OWNER TO CONFIRM], intended to trade as StudyCurrent. Proposed seller identity: [STUDYCURRENT LTD LEGAL NAME - OWNER TO SUPPLY], company number [STUDYCURRENT LTD COMPANY NUMBER - OWNER TO SUPPLY], place of registration [JURISDICTION OF REGISTRATION - OWNER TO SUPPLY], registered office/business address [REGISTERED OFFICE AND REQUIRED BUSINESS ADDRESS - OWNER TO SUPPLY]. Contact for privacy requests: support@studycurrent.co.uk. These are not yet verified legal disclosures. StudyCurrent Ltd is intended to be owned by OB Estate Group Limited; incorporation and final corporate details must be confirmed before launch.

Data and purposes

The application can process account email and sign-in tokens; order, payment and refund references; product access and expiry; consent wording, versions and timestamps; learner module/scenario progress, video watch/resume positions, quiz results and weak-topic records; support and issue reports; security/technical logs; and waitlist or marketing records only if those features are deliberately enabled. These data are used to provide requested accounts and content, take and administer payment, supply access, handle support/refunds, maintain security, meet accounting/legal duties and administer separately opted-in marketing. Do not send special-category data, payment-card details, passwords or information about children under 16 to support. Online enrolment is limited to people aged 16 or over under the current processor arrangement; no birth date is collected.

Proposed lawful bases

Proposed bases, to be documented by purpose before activation: contract for an account, paid content, order fulfilment and necessary support; legal obligation for required accounting/tax records; legitimate interests for proportionate security, fraud prevention and service reliability, subject to a recorded balancing assessment; consent for optional direct email marketing where relied upon. The marketing box is optional, unticked and separate from purchase. Buying, requesting a free resource or joining a one-time launch list is not ongoing marketing consent.

Optional offers and updates (draft, pre-launch)

Any marketing consent must be separate, optional and unticked by default. The checkout can record the email address, timestamp, exact wording/version and associated order when the box is explicitly selected. Marketing messages and progress reminders are disabled; none is being sent. The final lawful basis, wording, retention and unsubscribe controls must be internally confirmed before any campaign is enabled. Unsubscribing from marketing does not stop necessary purchase/account service messages.

Progress and access-expiry reminders (draft, pre-launch). The application has a separate reminder capability for account activity and the stated access end date. It is disabled; none is being sent. Keep these messages outside promotional automation until their purpose, lawful basis, opt-out treatment and privacy wording are approved internally.

Recipients and transfers

Current architecture uses SumUp for hosted payment, an Upstash/Redis-compatible store for account/order/progress records, Resend-compatible email delivery, the application host, and a configured Cook/CRM endpoint for purchase records when enabled. Owner-provided infrastructure evidence identifies the Upstash database electrical-training-hub on AWS London, UK (eu-west-2), with TLS enabled. Upstash’s current public terms incorporate its Data Processing Addendum for customer personal data. Its DPA permits necessary global processing with documented transfer safeguards; UK database location is not a promise of UK-only administrative processing. Other provider account-specific roles, locations and settings still require confirmation. The site owner must inspect the active provider accounts and contracts and fill the internal processor register before launch. No analytics or advertising pixel is intentionally active; do not add one for launch.

Retention

Data will be retained only for the operational or legal period in the published retention schedule. The system currently has no general automatic deletion/anonymisation job for order, consent, entitlement, progress or support records. A reviewed-request learning-record erasure route is implemented and tested with synthetic data, but execution is disabled until operational identity/retention procedures and provider-side handling are verified. A separate reviewed-request account-closure operation can deny course access and delete learning records, but its execution is also disabled pending operational review. Neither operation claims immediate deletion of accounting, certificate, support or provider/backup copies. Accounting records may be subject to statutory retention rules; the company must preserve only what is needed and separate those records from data that can be erased.

When signed in, you can submit an access, correction, erasure, restriction, objection, portability or other privacy request from your learner dashboard. The request is linked to your signed-in account and recorded for review. Submission does not itself delete or change data, account access or payment, and does not automatically send a reply; we review the request and handle it under the applicable rules. Do not include passwords or payment-card data.

Your rights and requests

Depending on the circumstances, you may request access, correction, erasure, restriction, portability or object to processing. Contact support@studycurrent.co.uk, identifying the account email and request type; do not send login links or passwords. The controller must verify identity proportionately, log the request and respond within applicable statutory deadlines. You may complain to the UK Information Commissioner’s Office at ico.org.uk. The controller must complete the ICO data-protection-fee self-assessment once its legal identity and processing facts are final; this notice does not assert whether a fee is payable.

Security and incidents

Access is restricted and sign-in uses time-limited email links and session controls. The controller must keep access to production secrets restricted, review access, and assess any personal-data breach promptly. Where notification is legally required, report to the ICO without undue delay and within the applicable statutory period, and inform affected people where required. Record facts, risk, decisions, containment and follow-up.

Cookies and device storage

See the Cookie policy for the current first-party session and pending-checkout cookies and the separate SumUp-hosted payment page. The module reader no longer stores reading position on the device. No analytics or advertising storage is used for launch. If this changes, the controller must update the notice and implement any required prior consent.

Changes and contact

This draft will be versioned when final facts and operating controls are verified. Contact support@studycurrent.co.uk with a privacy question. Terms · Refunds · Support

Version: internal draft 16 October 2026.