Privacy policy.

Plain English: we collect the minimum we need to deliver your course, we never sell your data, and we never share it with third parties for marketing.

Who we are. british-sign.co.uk is operated by Lisia Digital Limited, a company registered in Guernsey (company number 68545), with a UK VAT registration. We are the data controller for personal information processed through this website and the learner course area.

What we collect, and why

When you buy an enrolment

We collect the billing details we need to process your order: your name, postal address, email address, and (optionally) a telephone number. This information is needed to fulfil the contract of sale, issue a VAT-compliant invoice and contact you about your order.

When you (or someone you’ve enrolled) start the course

For each learner account we collect a first name, last name and email address. While the course is being used, the platform also records:

• Username and securely-hashed password
• Assessment scores and section progress
• Completion records and the data needed to issue your certificate
• Access timestamps and IP addresses (for security and support)

These records are used for course delivery, progress tracking, support and security. The one further use is when you ask us for a Duke of Edinburgh’s Award assessor report, described next; we do not use course records for anything else.

If you request a DofE assessor report

If you use the course for the Skills section of a Duke of Edinburgh’s Award and ask us for an assessor report, we use your course activity to prepare it:

• What we use – the weeks you have studied, your lesson scores and your access logs, together with your name.
• Who receives it – we prepare the report and submit it to eDofE, the Duke of Edinburgh’s Award’s official system, on your behalf. Your DofE Leader reviews it there.
• Lawful basis – consent. We prepare the report only when you ask us to, and you can withdraw that request at any time before we submit it.
• How long we keep it – we keep the report and the records used to prepare it for six years, in line with our billing records, so we can evidence a submission if it is ever queried.

When you visit the public website

We use Google Analytics on the public pages of british-sign.co.uk to understand which content is useful and where to improve. We do not run Google Analytics inside the learner course area. We also use functional cookies to remember your preferences (such as cookie-consent choices). You can review or change your cookie choices at any time on the Cookies Policy page.

Children and younger learners

The course may be used by under-18s. A child is always enrolled by a responsible adult – a parent, guardian, teacher or other adult acting for them – who sets up and manages the enrolment. In plain terms:

• Who creates the account – the purchasing adult enters the child’s first name, last name and email address on the enrolment dashboard. We do not knowingly collect a child’s details directly from the child.
• Who can see their progress – the adult who holds the enrolment. From the dashboard they can see the learner’s username, email address, assessment scores and completion status. They cannot see the learner’s password or detailed activity logs.
• Who receives course emails – the child’s login details are emailed to the address the adult entered for them. Emails about the enrolment itself (such as the dashboard link) go to the purchasing adult.
• Who can exercise data rights – the responsible adult can access, correct, export or delete the child’s data on their behalf by emailing support@british-sign.co.uk.
• DofE reports – if a report is requested for a younger participant, their course activity is handled exactly as described in “If you request a DofE assessor report” above.
• Certificate verification – the child’s name appears in the minimum certificate record we keep, so a certificate issued in their name can be verified. That record holds only the name, certificate number, completion date, course and version, and verification status.

Who we share data with

We do not sell personal data and we do not share it with third parties for marketing purposes. The following operational providers process limited data on our behalf so we can run the service:

• Krystal Hosting – UK-based VPS hosting for the website, learner platform and associated databases.
• Cloudflare – website security and traffic proxying.
• SendGrid – delivery of transactional emails such as login details, password resets and course notifications.
• Revolut Payments – payment processing for card transactions.
• Microsoft 365 – handling support enquiries received by email.
• Crisp – the chat widget you see at the bottom of each page.
• Google Analytics – aggregated usage analytics on the public website only.

Each of these providers is contractually required to process your data only for the purpose we’ve agreed and to protect it with appropriate security measures.

How we keep your data safe

The learner platform is hosted on a UK-based VPS at Krystal Hosting, protected by:

• HTTPS encryption across the website and learner platform
• Two-factor authentication on administrative access to hosting
• Strictly limited administrative access to learner data
• Regular software and security updates
• Server-level and application-level security monitoring
• Multiple backups taken every day

The enrolment dashboard works the same way for everyone, whether you have enrolled yourself, a family member, a class or a whole team. Each account holder can see only the learners on their own account. From the dashboard you can view usernames, email addresses, assessment scores and completion status, but cannot access learner passwords or detailed activity logs.

How long we keep your data

We keep your full learner account and progress record while your course access remains active (two years from your first login), so you can return to any section. After your access ends, we delete or minimise the learning record, but keep the minimum certificate record needed to verify a certificate we have issued in your name.

That minimum certificate record contains only: the learner’s name, the certificate number, the completion date, the course and version, and the verification status.

You can ask us to delete your personal data at any time. We will remove your account and learning records, although we may keep that same minimum certificate record where necessary to verify a certificate previously issued in your name.

Billing records are kept for the periods required by UK tax law, typically six years from the end of the financial year in which the transaction took place.

Children and learners under 18

Under-18 learners must be enrolled by a parent, guardian, teacher or other appropriate adult (the account holder), who accepts our terms on their behalf. We do not knowingly take enrolments directly from children.

• Login emails. The account holder sends each learner their username and login from the enrolment dashboard. We do not email children directly, other than to deliver a login the account holder has asked us to send.
• What the account holder can see. Only the learners on their own account, and only their username, email address, assessment scores and completion status – never passwords or detailed activity logs.
• Exercising data rights. A child, or a parent or guardian on their behalf, can ask us to access, correct or delete a learner’s personal data by emailing support@british-sign.co.uk. Where a school or other purchaser holds the account, we may ask them to confirm the request.
• Certificate verification. If a learner earns a certificate, we keep only the minimum certificate record described above, so it can be verified later even after course access ends.
• Duke of Edinburgh’s Award. If the course is used for a DofE Skills section, we prepare an assessor report from the learner’s access dates and progress and submit it to eDofE on the account holder’s instruction, sharing only what the report requires.

Your data-protection rights

Lisia Digital Limited is established in Guernsey and processes personal data primarily under the Data Protection (Bailiwick of Guernsey) Law, 2017. UK data-protection law (the UK GDPR and Data Protection Act 2018) may also apply in some circumstances.

You have the right to:

• Be informed about how we use your data (this page)
• Access the personal data we hold about you
• Correct anything inaccurate or incomplete
• Have your data erased, subject to the limits described above
• Restrict or object to certain types of processing
• Receive a portable copy of the data you’ve provided to us
• Not be subject to a decision based solely on automated processing (we don’t do any)

To exercise any of these rights, email support@british-sign.co.uk and we’ll respond within one calendar month.

Complaints

We hope to resolve any concern directly. If you are unhappy with how we have handled your personal data, you can complain to the Office of the Data Protection Authority (ODPA) in Guernsey, at odpa.gg. Where UK data-protection law applies, you may also have the right to complain to the UK Information Commissioner’s Office (ICO), at ico.org.uk.

Changes to this policy

We may update this page from time to time. The “last updated” date at the top of the page always shows the current version. Material changes will be communicated to active learners by email.

Contact

• Email support@british-sign.co.uk
• Use the chat widget at the bottom of any page
• Visit our contact page for postal address and other options