Privacy Notice

This notice explains how we collect, use, share, and protect personal data when you use the Service.

We may collect:

1. Account Data: name, email, phone (optional), profile details
2. Verification Data: OTP delivery/verification logs (timestamps/status)
3. Transaction Data: orders, payment status, references, receipts/invoices (we do not store full card numbers when using a payment provider)
4. Learning Data: enrolled courses, progress, quiz results/scores, assignment submissions (metadata and uploads if applicable)
5. Community Data (UGC): comments/questions/files you post (if community features exist)
6. Technical and usage information: session identifiers, device and browser information, activity logs, and security/audit logs. Your IP address is used only to limit request rates and prevent abuse: we do not store the address itself, but a hash of it computed with a secret key held by our system, which cannot be turned back into your IP address by anyone who does not also hold that key. That value is deleted within about half an hour, and it is not recorded in your learning records. (Our network provider sees the IP address of every request as a normal part of delivering it — see section 6.)
7. Preferences & Consents: language, notification preferences, cookie preferences, acceptance/consent records

We use data to:

• Provide and administer your Account and verify identity
• Process payments, orders, and deliver receipts/invoices
• Deliver learning services: course access, progress tracking, assessments, certificates
• Provide support and handle requests/complaints
• Maintain security, prevent fraud/abuse, and audit activity
• Send essential transactional/security notifications
• Send learning/marketing messages only according to your preferences/consent

Depending on the context, we rely on:

• Contract: to provide the Service you request (account, access, purchases)
• Legitimate interests: security, fraud prevention, service improvement (balanced against your rights)
• Consent: marketing communications and non-essential cookies (analytics/marketing)
• Explicit consent: for health data or other special category data you give us in support of a request for a reasonable adjustment. You give that consent separately on the request form and may withdraw it at any time.
• Legal obligation: accounting/tax/other legal compliance where applicable

We share data with:

• the awarding organisation (such as VTCT), for learners on a regulated qualification — to register you, for quality assurance, and to issue your certificate
• the hosting and infrastructure providers that run the platform
• the development and operations team we appoint to run the platform — for maintenance, troubleshooting and data recovery
• our email delivery provider, for receipts, notifications and account emails
• the sign-in providers Google, Apple and Facebook — but only if you choose to sign in that way
• our AI media production providers (HeyGen and ElevenLabs) — instructor data only, and only where that instructor has given explicit consent; see "Instructors' Personal Data"
• professional advisers or public authorities, where the law requires it or to protect our legal rights
• Our website analytics provider (Google Analytics 4) — only where you have consented to analytics cookies. What we send is usage data such as which pages were opened, time spent and device type. We do not send your name, email address or other directly identifying details to this service, and we do not enable its advertising features.

We have no marketing or advertising partners, and we do not currently use an external payment processor — you transfer money to our bank account directly.

We do not sell your personal data, ever.

All processors act under contractual obligations to protect data.

Our main systems and database are located in the United Kingdom (London). Course media files and database backups are stored in the European Economic Area (the Netherlands), which the UK recognises as providing an adequate level of data protection. Some information also passes outside that region as a normal part of how the service works:

• our content delivery and DNS network (Cloudflare), which sees the IP address and page address of every request and has points of presence worldwide
• our shared email delivery relay, where the message may contain your name and order number
• the sign-in token exchange with Google, Apple or Facebook, only if you choose to sign in that way
• access for maintenance and technical support by our development and operations team, who work from Thailand. Such access is limited to those who need it to do their job.

The service's media and document files — lesson videos, images, certificate PDFs and receipts — are stored in our infrastructure provider's data centre in Amsterdam, the Netherlands (EEA). Unlike the channels above, this is storage, not mere transit. Transfers between the UK and the EEA are covered by mutual adequacy decisions, so no further safeguard is required.

Where you consent to analytics cookies, your usage data is processed by our analytics provider, Google Analytics. Google may process this data outside the United Kingdom. Where it does, the transfer is covered by the data protection terms in our agreement with Google.

Transfers out of the UK are not all the same. Storage in the European Economic Area (the Netherlands) relies on the UK's recognition that the EEA provides adequate protection, so no further transfer agreement is needed for it. For access from outside the UK and the EEA, we limit who may access data and what they may do with it, and we are putting the required transfer paperwork in place.

We keep each kind of information for the following periods:

• Account and profile information: for as long as your account is open. It is erased when you delete your account or ask us to.
• Orders, receipts and payment slips: 6 years from the end of the financial year they fall in, to meet UK company tax record-keeping duties and so that we can answer a contractual dispute within the limitation period.
• Learning records, assessment evidence and portfolios: for as long as your qualification record must stand, because the awarding organisation and its external quality assurers may need to check it. These records are designed so that they can only be added to — never edited or deleted.
• Issued certificates and their verification records: kept for the lifetime of the qualification, so an employer or a regulator can always confirm that your certificate is genuine. A certificate nobody can verify is worth nothing to you.
• Consent and acceptance records: kept alongside your account record, and retained after erasure, because they are the proof that we obtained your permission properly.
• Evidence supporting a reasonable adjustment request (including health data, if any): as set out in section 7A.
• Database backups: retained for 14 days, then deleted automatically.
• Course media files: kept for as long as that course is offered.
• Previous versions of media files that are replaced or deleted: retained for 30 days, then deleted automatically.
• Security and system audit logs: 12 months.
• Support correspondence: 24 months.

The last two periods are our own operational choice, not a period the law requires of us.

If you ask us for a reasonable adjustment to an assessment, we ask only for as much supporting information as we need to decide that request. We ask about impact, not about conditions: you do not have to tell us a diagnosis, and professional evidence is optional, not required.

This information is kept separately from your assessment evidence and is accessible only to the approving officer and to staff who need it to put the adjustment into practice. Your assessor is told which adjustment is approved, not your health information, and it does not travel with the evidence we claim to the awarding organisation — unless prior approval is required, in which case we will tell you before we send it.

Retention: kept only as long as needed to arrange the adjustment, review it, and satisfy the awarding organisation's audit; then deleted.

You have the right to see the information we hold about you, to have inaccurate information corrected, to ask us to erase it, to restrict or object to how we use it, to receive a copy in a machine-readable form, and to withdraw your consent where we rely on it.

You can delete your account yourself from your profile page. For any other request, contact info@taitam-d.com. We may ask you to confirm your identity first, and we will respond within one month as the law requires.

When you delete your account we erase your name, email address, phone number, postal address and profile details, and the records that remain are linked only to an internal identifier that no longer leads back to your name or contact details. There are, however, some things we cannot remove, and you should know what they are before you decide:

• the name printed on any certificate already issued to you — removing it would make the certificate in your hand impossible to verify
• your learning and assessment evidence, which is the evidence behind your qualification and may be inspected by the awarding organisation
• the delivery record of emails we sent you, which contains your email address
• audit entries recorded at the time an action happened, and technical records of which parts of a lesson's media were delivered to you and when. These records identify your account — not your IP address or any other network address.
• orders, receipts and payment slips, for the retention period set out in section 7

This notice protects our instructors as well as our learners. For instructors we additionally collect and use the following, only within the scope each instructor has consented to in writing, item by item:

• name, the English spelling they have confirmed themselves, biography, qualifications and photographs — for instructor profile pages, textbooks, teaching videos and promotional material
• facial images and voice samples used to create a digital representation (AI avatar) and a synthetic voice (voice clone) — this data identifies a person and is treated as sensitive; we process it only on the basis of explicit consent

To create avatars and synthetic voices we use two external processors — HeyGen (moving images) and ElevenLabs (voice) — which process the data on servers outside the UK. Section 6 explains how we handle transfers out of the UK and what is and is not yet in place. We do not pass on, sell or sub-license any instructor's avatar or voice model to anyone.

An instructor may withdraw any consent at any time. The effect of withdrawal, and the time limits that apply to each step, are as set out in the Instructor Consent Form.

We use necessary cookies to operate the Service, a cookie to remember your language, and — only with your consent — analytics cookies. We use no advertising cookies. The full list of cookies this site actually creates is in the Cookie Policy.

Some pages in this service carry a temporary code in their web address — setting a new password, confirming an email address, accepting an invitation, and checking a certificate. We do not load the analytics tool on those pages at all, so their addresses are never sent to the analytics provider.

On other pages, we configure the analytics provider to strip sensitive parameters from the data it stores and reports.

We implement reasonable security measures including access controls, encryption in transit, monitoring, and audit logging.

If you are unhappy with how we handle your data, please contact us first at info@taitam-d.com. If that does not resolve it, you have the right to complain to the UK Information Commissioner's Office (ico.org.uk), the UK's data protection regulator.

We may update this notice and will display the updated version/effective date. Material changes may require renewed acknowledgement.