Privacy notice
What Certify Academy does with your personal data, and what you can do about it.
Last updated 27 September 2026.
This notice explains what Certify Academy does with your personal data, and what you can do about it. It covers this site only. Badges and certificates you earn are issued on the Certify platform, which has its own notice.
Who is responsible
Certify Skills Limited is the data controller. Registered office: 7 Bell Yard, London, WC2A 2JR. Registered in England and Wales, company number 11369436. ICO registration ZB949024.
For anything in this notice, including a request to see, correct or delete your data, email credential@certify.one. We reply within one month.
For Brazil's LGPD, the same address reaches our encarregado, the person responsible for data protection questions.
What we collect, and why
When you create an account
| What | Why | Our legal basis |
|---|---|---|
| Email address | To sign you in, because there is no password, and to send you service email about your courses | Contract: you cannot have an account without it |
| Your name | It is printed on the badges and certificate you earn | Contract |
| Organisation and job title, if you give them | To understand who the courses are reaching | Legitimate interests, and they are optional |
| Preferred language | To show the site and write to you in the right language | Contract |
| That you accepted the terms of use, which version, and when | So there is a record of what you agreed to | Contract |
While you are learning
| What | Why | Our legal basis |
|---|---|---|
| Which lessons you have finished | To show your progress and unlock the next step | Contract |
| What you write or upload for a practical task and the final project | It is the work the course asks for, and submitting it opens the module quiz | Contract |
| Your quiz attempts, the questions you were served, your answers and your score | To mark the quiz, show you where you went wrong, and decide whether you have earned the badge | Contract |
| Badges and certificates issued to you | To show them on your dashboard and to avoid issuing the same one twice | Contract |
Automatically
| What | Why | Our legal basis |
|---|---|---|
| When you were last active | To know whether your account is still wanted, for the deletion schedule below | Legal obligation, and legitimate interests |
| A record that a sign in link was requested for your address | To rate limit the form so it cannot be used to flood an inbox | Legitimate interests |
| That you joined, or signed back in, with your profile details and which courses you have started | Sent to two people in the Certify team by email, so they can see who is using the Academy. It never leaves Certify | Legitimate interests |
| Which pages you open, the site that linked you here, any campaign tag in that link, your country, and whether you use a phone, tablet or computer and which browser | To see which pages help people and how they find the Academy. Counted without cookies: your IP address and browser details are turned into a code that changes every day and cannot be traced back to you, and the address itself is never stored. Kept for 24 months | Legitimate interests |
| Your name, email address, organisation, job title, language, when you joined and whether you asked to learn more about Certify | Recorded in HubSpot, our customer record system, so our team knows you are taking the Academy. The record says whether you asked to learn more, and without that we do not email you about Certify | Legitimate interests |
If you ask to learn more about Certify
Someone from our team only emails you about Certify, the platform behind the Academy, if you tick the box to say you would like to learn more. It is never ticked for you. You can untick it on your account page at any time, or reply to any of those emails and ask us to stop. The legal basis is your consent, and withdrawing it is as easy as giving it.
Course reminders are separate. If you start a course and do not come back, we may send one nudge about that course. That is service email rather than marketing, and it has its own off switch on the same page.
Cookies
We use strictly necessary cookies only:
- a session cookie that keeps you signed in
- a cookie remembering which language you chose
- a cookie set by Cloudflare Turnstile, the check on the sign in form that tells a person from a bot
There is no analytics, advertising or tracking cookie on this site, which is why you are not asked to accept anything. We count visits without cookies, as described above, and if your browser sends a Global Privacy Control or Do Not Track signal we do not count yours at all.
Who else sees your data
We do not sell your data, and we do not share it for anyone else's marketing. These suppliers process it on our instructions so that the site works:
| Who | What they do | What they see |
|---|---|---|
| Supabase | Runs the database, the sign in system and the file storage | Everything above |
| Vercel | Hosts the site | Requests to the site |
| Postmark | Sends our email | Your address and the content of our emails to you |
| Cloudflare | Turnstile, the bot check on the sign in form | Technical signals from that form |
| Certify | Issues your badges and certificate | Your name and email address, so the credential can be made out to you and sent |
| HubSpot | Our customer record system | Your name, email address, organisation, job title, language, when you joined and whether you asked to learn more about Certify |
Some of these suppliers are outside the United Kingdom and the European Economic Area, and some are outside Brazil. Where that is the case the transfer is covered by the safeguards those laws require, such as standard contractual clauses.
We will also disclose data if the law requires it.
How long we keep it
If you stop using your account we delete it, and everything in it, 24 months after you were last active. We email you 30 days before that happens. Signing in once is enough to keep the account, and resets the clock.
Your record in HubSpot is kept separately and is not removed when your Academy account is. Email us and we will delete it.
You can delete your account yourself at any time from your account page. It goes immediately and cannot be recovered.
The visit counts described above are deleted after 24 months. They cannot be linked to you or your account, so they are not part of your account and are not removed with it.
Badges and certificates already issued to you are not affected by either. They are yours, they live in your Certify account, and they stay valid and verifiable. Deleting your Academy account does not revoke a credential you earned.
Your rights
Under UK GDPR and Brazil's LGPD you can ask us to:
- give you a copy of what we hold about you
- correct anything that is wrong
- delete your account and its data
- restrict or object to what we do with it
- send your data to you or someone else in a portable form
- withdraw consent to marketing email, at any time
Email credential@certify.one and we will reply within one month. We will not charge you and we will not ask why.
If you are not satisfied with our answer you can complain to a regulator: in the United Kingdom the Information Commissioner's Office at ico.org.uk, and in Brazil the Autoridade Nacional de Proteção de Dados at gov.br/anpd.
Changes to this notice
If we change how we use your data we will update this page and, where the change matters to you, tell you by email. The date at the top shows when this version took effect.