Skip to main content
London School of Applied Excellence

Privacy Policy

London School of Applied Excellence (LSAE)

Last updated: May 2026

This Privacy Policy explains how Patronica Limited, England & Wales (“LSAE”, “we”, “our”, or “us”), collects, uses, stores, shares, and protects your personal data when you visit our website, create an account, or enrol on any of our courses. We are committed to handling your data with transparency and care, in full compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Data Controller

Data Controller: Patronica Limited, England & Wales (LSAE), registered in England and Wales.

Data Protection enquiries: support@lonsea.co.uk

We aim to respond to all data protection enquiries within 30 calendar days.

2. Personal Data We Collect

We collect and process the following categories of personal data:

  • Identity Data — Full name, date of birth, username, or similar identifier.
  • Contact Data — Email address, telephone number, and postal address.
  • Account & Enrolment Data — Login credentials (hashed), course enrolment history, learning progress, assessment results, and certificates.
  • Payment Data — Billing name and address. We do not store full card details; all payments are processed by PCI-DSS compliant providers (Stripe).
  • Technical Data — IP address, browser type, device type, time zone, and pages visited.
  • Usage & Behavioural Data — Click behaviour, search queries, time on lessons, and quiz interactions.
  • Communication Data — Records of emails, support tickets, and feedback you send us.
  • Marketing Preferences — Your stated preferences regarding marketing communications.

3. How We Use Your Data

  • Course delivery and account management (contract performance).
  • Payment processing and financial administration.
  • Student support and enquiry resolution.
  • Service communications (account and course updates).
  • Marketing communications (with consent or legitimate interest).
  • Service improvement and research (anonymised where possible).
  • Safety, security, and fraud prevention.
  • Legal and regulatory compliance.

4. Legal Basis for Processing

Under UK GDPR, we rely on the following legal bases:

  • Contract (Article 6(1)(b)) — To deliver courses and manage your account.
  • Legal Obligation (Article 6(1)(c)) — To comply with UK tax and other laws.
  • Legitimate Interests (Article 6(1)(f)) — For fraud prevention, service improvement, and direct marketing to existing customers.
  • Consent (Article 6(1)(a)) — For non-essential cookies and direct marketing to prospects.

5. Data Sharing

We do not sell, rent, or trade your personal data. We may share data with:

  • Service providers — Payment processors (Stripe), email services (Resend), cloud hosting (Vercel, Supabase), and analytics (PostHog).
  • Accreditation bodies — where a course is accredited, for certificate verification purposes.
  • Legal authorities — Where required by law or to protect our legal rights.

All third-party processors are contractually bound to protect your data and process it only for the stated purposes.

6. International Transfers

We store data primarily within the UK and EEA. Where data is transferred outside these areas (e.g. to US-based service providers), we ensure appropriate safeguards are in place, including adequacy decisions, International Data Transfer Agreements, and Standard Contractual Clauses approved by the ICO.

7. Data Retention

  • Account data — 6 years following end of enrolment or last activity.
  • Financial records — 7 years (HMRC requirements).
  • Certificate records — Retained indefinitely for verification purposes.
  • Marketing data — Until consent is withdrawn.
  • Technical/usage data — Up to 13 months, then anonymised or deleted.

8. Your Rights

Under UK GDPR, you have the right to:

  • Access your personal data (Subject Access Request).
  • Rectify inaccurate or incomplete data.
  • Request erasure (“right to be forgotten”).
  • Restrict processing in certain circumstances.
  • Data portability (receive your data in a structured, machine-readable format).
  • Object to processing based on legitimate interests.
  • Withdraw consent at any time (without affecting prior processing).

To exercise any of these rights, contact us at support@lonsea.co.uk. If you are not satisfied with our response, you have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including SSL/TLS encryption in transit, encryption at rest, role-based access controls, secure cloud infrastructure, regular security audits, and incident response procedures. In the event of a personal data breach posing a risk to your rights, we will notify the ICO within 72 hours and inform affected individuals without undue delay.

10. Children’s Privacy

Our services are not directed at individuals under 18 years of age. We do not knowingly collect personal data from minors. If you believe a child has provided us with personal data, please contact us immediately and we will take steps to delete it.

11. Changes to This Policy

We may update this policy from time to time. Where changes are material, we will provide notice by email or a prominent notice on our website at least 14 days before changes take effect. For historical versions, contact support@lonsea.co.uk.

12. Contact

For all data protection and privacy enquiries, contact us at support@lonsea.co.uk.

London School of Applied Excellence is operated by Patronica Limited, England & Wales. Supervisory authority: Information Commissioner’s Office (ico.org.uk)