Privacy Policy
Privacy Policy
Version 1.0 — Effective date: 13 October 2026
This Privacy Policy explains how Spartan Education Services Ltd, trading as Spartans EDU (“we”, “us”, “our”), collects, uses, stores, shares, and protects your personal data when you use spartans-edu.org, purchase or access an online course, contact us, or interact with our emails and marketing.
We are the data controller for personal data collected through our website, courses, and communications.
Who we are
Spartan Education Services Ltd
Trading as: Spartans KM International / Spartans EDU
Company number: 13072345
Registered office: 54 Ridgestone Avenue, Bilton, Hull, England, HU11 4AJ
Privacy, data-protection, support, and general enquiries: [email protected]
You can view our ICO registration on the ICO public register: Registration reference ZC114181.
What personal data we collect
We may collect and process the following personal data:
Account and course data
- Full name.
- Email address.
- Date of birth, where required for age verification, safeguarding, or course eligibility.
- Username and password information, stored in encrypted or hashed form where applicable.
- Course enrolment records.
- Course progress, completed lessons, quiz results, certificates, and activity within the Course Platform.
- Support enquiries, complaints, and communications with us.
Payment and transaction data
- Billing name.
- Billing address.
- Email address used for the purchase.
- Purchase history.
- Invoice, receipt, and refund records.
- Limited payment-related information.
We do not store your full card details on our own systems. Card payments are processed by our payment providers, including Stripe and PayPal. Your card data is handled by those providers under their own security and privacy controls.
Technical and usage data
- IP address.
- Device type, operating system, and browser type.
- Pages viewed, links clicked, and time spent on pages.
- Referring website or campaign information.
- Cookies and similar tracking technologies, where used.
- Login and access records.
- Error logs and security records.
Marketing data
- Name.
- Email address.
- Marketing preferences.
- Records of emails opened, links clicked, and campaigns received, where applicable.
- Records of consent, withdrawal of consent, objection, and unsubscribe requests.
Information you must provide
Some personal data is necessary for us to enter into and perform our contract with you, including your name, email address, payment and billing information, and account details.
If you do not provide the information required to process payment, create an account, verify eligibility where necessary, or provide access to the Course, we may be unable to complete your purchase or provide the Course.
Why we use your data and our lawful bases
We only use personal data where we have a lawful basis under UK data-protection law.
Purpose | Personal data used | Lawful basis |
|---|---|---|
To create your account and provide access to the Course | Name, email, date of birth where required, login details, course progress | Performance of a contract |
To process payments, refunds, invoices, and purchase records | Billing name, billing address, email, transaction data | Performance of a contract and legal obligation |
To provide customer support and respond to enquiries | Name, email, messages, account and course information | Performance of a contract and, where relevant, legitimate interests |
To maintain security, prevent fraud, and protect the Course Platform | IP address, device data, login records, security logs | Legitimate interests and legal obligation |
To improve the website, courses, and user experience | Usage data, device data, course-progress data, analytics data | Legitimate interests |
To send transactional emails, receipts, course-access details, and important service updates | Name, email, purchase and account data | Performance of a contract and legal obligation |
To send marketing emails, offers, and course updates | Name, email, marketing preferences, engagement data | Consent; or, for existing individual customers, our legitimate interests where the legal conditions for the “soft opt-in” are met |
To comply with tax, accounting, consumer-rights, and legal-record requirements | Purchase, payment, invoice, refund, and acceptance records | Legal obligation and legitimate interests |
To keep records of terms acceptance and immediate-access acknowledgements | Name, email, account ID, timestamp, checkbox selections, checkout records | Performance of a contract and legitimate interests |
To verify age or manage safeguarding requirements, where applicable | Name, email, date of birth, parental/guardian information | Legal obligation and, where relevant, legitimate interests |
Marketing and the soft opt-in
For existing individual customers, we may rely on our legitimate interests to send marketing about similar courses or services where the legal conditions for the “soft opt-in” are met. This may apply where you purchased, or discussed purchasing, similar products or services from us, were given a clear opportunity to opt out when we collected your details, and are given an opt-out option in every marketing email.
You can unsubscribe from marketing emails at any time by using the unsubscribe link in an email or by contacting us at [email protected]. You may also object to marketing based on legitimate interests at any time. We will stop sending direct marketing to you when you unsubscribe or object.
Our legitimate interests
Where we rely on legitimate interests, these include operating and improving our website and Course Platform, providing customer support, maintaining security, preventing fraud and misuse, protecting our intellectual property, keeping appropriate business records, and promoting similar courses or services to existing customers where permitted by law.
We consider and balance these interests against your rights and freedoms before relying on this lawful basis. You may object to processing based on legitimate interests in certain circumstances.
Cookies and analytics
We may use cookies and similar technologies to:
- Keep you logged in.
- Remember your preferences.
- Secure the website and Course Platform.
- Understand how visitors use the site.
- Measure the performance of marketing campaigns.
- Enable embedded video content, including YouTube, Vimeo, and Bunny.
Where cookies are not strictly necessary, we will seek your consent through our cookie banner or preference settings. Analytics cookies are not strictly necessary and require consent before they are set.
We may use Google Analytics to understand website usage. Google Analytics may collect information such as your IP address, device information, pages viewed, and interaction data.
Where we embed YouTube, Vimeo, or Bunny videos, those providers may set cookies or use similar technologies and may collect information such as your IP address, device information, and viewing activity. This may occur when you interact with an embedded video, depending on the embedding and privacy settings used.
Where an embedded-video provider uses non-essential cookies or similar technologies, we will use a privacy-enhanced or equivalent configuration where available and will either obtain consent before loading the embedded content or provide a click-to-load option that explains the relevant technology will be used when the video is played.
You can manage or withdraw cookie preferences through the cookie settings on our website or through your browser settings. Further details are set out in our Cookie Policy: https://spartans-edu.org/cookie-policy
.
Email engagement tracking
Where our marketing emails use tracking pixels or similar technologies to measure opens, clicks, device information, or email engagement, we will provide appropriate information and obtain consent where required by applicable law.
Where you withdraw consent for email-engagement tracking, where applicable, we will stop using tracking technologies in future marketing emails sent to you.
You can unsubscribe from marketing emails at any time using the unsubscribe link in the email or by contacting us at [email protected].
Children and young people
The Course is purchased by adults. Where we permit a person under 18 to access the Course, a parent or legal guardian must make the purchase, accept the relevant terms, and provide any required information on that person’s behalf.
We collect only the personal data reasonably necessary to provide access, manage safety and safeguarding, and administer the Course. We do not use a child’s personal data for direct marketing.
Parents or legal guardians may contact us at [email protected] regarding a child’s personal data or privacy rights.
Health information
We do not ask you to send us medical histories, medical records, or detailed health information by email or through general support channels.
You are responsible for deciding whether participation in physical training is appropriate for you and for seeking advice from a suitably qualified healthcare professional where necessary. Please do not send medical records or detailed health information unless we specifically ask you to provide it for a defined safeguarding, accessibility, or safety purpose.
If we ever need to collect health information, we will explain why it is needed, the lawful basis and special-category condition relied on, who can access it, how long it will be kept, and the additional safeguards applied.
Who we share your data with
We share personal data only where necessary to operate our business, provide the Course, process payments, comply with the law, or protect our rights.
We use the following service providers and processors:
Provider | Purpose | Data shared |
|---|---|---|
Stripe | Payment processing, fraud prevention, refunds, and transaction records | Name, email, billing information, transaction data; card details are handled by Stripe |
PayPal | Payment processing, refunds, and transaction records | Name, email, billing information, transaction data |
Brevo | Email delivery, marketing communications, contact management, and email engagement tracking | Name, email, marketing preferences, engagement data |
Vimeo | Video hosting and streaming of Course Content | IP address, device and technical data, viewing data |
Bunny | Video delivery, streaming, storage, or content-delivery support for Course Content | IP address, device and technical data, viewing data |
YouTube | Video hosting, embedding, and streaming of Course Content or promotional videos | IP address, device and technical data, viewing data, and cookie or similar tracking data where YouTube embeds are used |
Backblaze B2 | Cloud storage and backup of course materials or related files | Data necessary for storage, delivery, security, and backup |
Cloudflare | Website security, content delivery, performance, and protection against malicious traffic | IP address, device and technical data, security and access logs |
Google Analytics | Website and marketing analytics | IP address, device data, pages viewed, usage data |
These providers act as processors or independent controllers depending on the service and the nature of the processing. For example, Stripe may act as a processor for payment processing and may act as an independent controller for certain fraud-prevention or regulatory activities.
We may also share personal data where required by law, court order, regulator, tax authority, or law-enforcement body, or where necessary to establish, exercise, or defend legal claims.
International data transfers
Some of our service providers may process personal data outside the United Kingdom, including in the United States or other countries where they operate.
Where we make or permit an international transfer of personal data, we will ensure that an appropriate safeguard is in place. Depending on the provider and destination, this may include a UK adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another lawful transfer mechanism recognised under UK data-protection law.
You may contact us at [email protected] for further information about the relevant transfer safeguards.
How long we keep your data
We keep personal data only for as long as necessary for the purposes set out in this Privacy Policy, or as required by law.
Type of data | Retention period |
|---|---|
Account and course-access data | For the duration of your Course access, then for 12 months after access ends, unless needed longer for legal, dispute, or record-keeping purposes |
Purchase, invoice, payment, and refund records | Six years from the end of the financial year to which they relate, or longer where required by law, an ongoing HMRC enquiry, or the need to establish, exercise, or defend legal claims |
Marketing consent and unsubscribe records | For as long as needed to evidence consent or objection, and for 2 years after the last marketing interaction, unless a longer period is required |
Email marketing engagement data | For 2 years after the last meaningful interaction, unless you remain an active subscriber |
Support enquiries and complaints | For 3 years after the matter is closed |
Terms acceptance, immediate-access acknowledgement, and Live Services request records | For 6 years after the end of the relevant contract or access period, to support legal and consumer-rights records |
Technical, security, and server logs | For 12 months, unless required longer for security, fraud prevention, or legal reasons |
Analytics data | In accordance with the applicable analytics provider’s retention settings and our configured retention period |
Where we do not use a fixed retention period, we retain data only while it remains necessary for the purpose for which it was collected, or according to clear criteria such as the length of the customer relationship, legal limitation periods, tax rules, or the need to defend legal claims.
How we protect your data
We use appropriate technical and organisational measures to protect personal data, including:
- Secure hosting and encrypted connections.
- Access controls and strong authentication.
- Limited access to personal data on a need-to-know basis.
- Secure payment processing through Stripe and PayPal.
- Regular review of access, security, and data-protection practices.
- Backups and disaster-recovery arrangements.
No online service can guarantee absolute security. However, we take reasonable steps to protect your personal data from unauthorised access, loss, misuse, alteration, or disclosure.
Your data-protection rights
Under UK data-protection law, you have the following rights:
1. Right to be informed
You have the right to be informed about how we collect and use your personal data. This Privacy Policy provides that information.
2. Right of access
You can request confirmation that we hold personal data about you and request a copy of that data, along with certain supplementary information.
3. Right to rectification
You can ask us to correct personal data that is inaccurate or complete personal data that is incomplete.
4. Right to erasure
You can ask us to delete your personal data in certain circumstances, for example where it is no longer necessary, where you withdraw consent, or where we are processing it unlawfully. This right is not absolute; we may need to retain some data for legal, tax, security, or contractual reasons.
5. Right to restrict processing
You can ask us to restrict or suppress processing of your personal data in certain circumstances, for example while we investigate a dispute about accuracy or your objection to processing.
6. Right to data portability
Where processing is based on consent or contract and is carried out by automated means, you can request a copy of your personal data in a structured, commonly used, machine-readable format, or ask us to transfer it to another organisation where technically feasible.
7. Right to object
You can object to processing based on our legitimate interests in certain circumstances. You also have an absolute right to object to direct marketing at any time.
8. Rights relating to automated decision-making
We do not carry out automated decision-making that produces legal effects or similarly significantly affects you. If this changes, we will update this Privacy Policy and provide the required information.
How to exercise your rights
To exercise any of your rights, contact us at:
Email: [email protected]
Post: Spartan Education Services Ltd, 54 Ridgestone Avenue, Bilton, Hull, England, HU11 4AJ
Please include:
- Your full name.
- The email address associated with your account or purchase.
- Details of the information or right you are requesting.
- Any relevant order, course, or account reference.
We may need to verify your identity before responding. We will respond within one month of receiving a valid request. Where a request is complex, or we receive multiple requests, we may extend the response period by up to two further months, and we will tell you if we do so.
Complaints
If you are unhappy with how we handle your personal data, please contact us first at [email protected] so that we can try to resolve the issue.
You also have the right to complain to the Information Commissioner’s Office:
Information Commissioner’s Office
Website: https://ico.org.uk/
Changes to this Privacy Policy
We may update this Privacy Policy from time to time. We will publish the updated version on this page and update the effective date above.
Where changes materially affect how we use your personal data, we will provide a more prominent notice where appropriate.