Privacy Notice
Last updated 6 November 2026
This explains what personal data ProjectFlow Academy collects, why, and what your rights are. It is written to be read, so we've kept it short and plain.
Who we are
ProjectFlow Academy is run by Project Flow Ltd. You can contact us at info@projectflow.co.uk.
We are the "controller" of your personal data under UK data protection law (UK GDPR and the Data Protection Act 2018).
What we collect
- Account details: your name, email address, and which courses you can access. Your password is stored only as a scrambled (hashed) value that nobody, including us, can read.
- Learning activity: which lessons you have completed, which lessons you have opened (and how often and when), and when you were last active.
- Login records: the date and time of each login, the approximate country it came from, and a short description of your device (browser and operating system).
- Security data: if a login or password-reset attempt fails, or when a contact-form message is sent, we briefly keep the IP address and email used so we can block people guessing passwords and stop spam. These records are deleted within 24 hours.
- Contact form: if you write to us, we receive the name, email address and message you enter. We use them only to reply, and keep the email for as long as we need to deal with your enquiry.
- Emails: we only email you for account reasons, such as an invitation or a password reset.
We do not use advertising or analytics trackers, we do not sell your data, and we do not currently take payments on this site, so we hold no card details.
Why we use it, and our legal basis
- To give you access to your courses and track your progress: needed to provide the training you have signed up for (contract).
- To keep the site secure and prevent misuse, using login records and the security data above (our legitimate interests).
- To see how the courses are used so we can improve them, for example which lessons are opened and where people stop (our legitimate interests). If your employer or organisation arranged your training, we may also share your progress and completion with them.
Who we share it with
We use a small number of providers to run the site. They only process data on our behalf:
- Cloudflare: hosts the site, stores our database and uploaded files, and provides the "security check" shown on the login pages.
- Mailgun: sends our emails (we use its EU region).
- Video providers (YouTube, Vimeo, Loom, Bunny): course videos are embedded from these services. When you play a video, that provider receives details such as your IP address and device and may set its own cookies, under its own privacy policy. We use YouTube's privacy-enhanced mode where we can.
We don't share your data with anyone else unless the law requires it.
Transfers outside the UK
Cloudflare and Mailgun are US-headquartered companies and may process data outside the UK and EEA. Where they do, it is under approved safeguards such as the UK International Data Transfer Agreement or standard contractual clauses.
Cookies
We set one cookie, called sid, to keep you logged in. It is essential for the site to work, lasts up to 30 days and is deleted when you log out, so no cookie banner is needed. The security check from Cloudflare and the video players above may set their own cookies. We do not use analytics or advertising cookies, and we host our own fonts, so your browser does not contact Google Fonts.
How long we keep it
- Your account and learning activity: until your access ends or you ask us to delete it.
- Login sessions: 30 days. Failed-login security records: 24 hours.
- After you are deleted, copies can remain in our database backups for up to 90 days, then they are overwritten.
Your rights
You can ask us to:
- give you a copy of your data;
- correct anything that's wrong (you can also change your name and email yourself in Account settings);
- delete your data;
- restrict or stop how we use it, or object to it; and
- give you your data in a portable format.
Email info@projectflow.co.uk and we will reply within one month. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk (0303 123 1113). We'd appreciate the chance to put things right first.
Security
The site uses HTTPS, passwords are hashed, access is limited to the people who need it, and repeated failed logins are blocked. No system is perfectly secure, so please use a strong, unique password.
Who this is for
ProjectFlow Academy is for adults taking professional training. It is not intended for anyone under 18.
Changes
If we change this notice in a meaningful way we will update the date above and, for significant changes, tell you by email.