Privacy policy.

We collect the information we need to run British Sign and deliver your course – your account and billing details, your course progress and certificates, and basic security information. We never sell your data, and we never share it with third parties for marketing.

Who we are. British Sign (british-sign.co.uk) is a trading name of Lisia Digital Limited, a company registered in Guernsey (company number 68545), with a UK VAT registration. The data-protection role we take – data controller or data processor – depends on the personal information involved and who decided to collect it. The next section, “Our role”, explains this: in short, we are usually the controller for individual customers, and usually a processor acting for a school or organisation that enrols its own learners.

Our role: data controller or data processor

Data-protection law uses two terms: the data controller decides why and how personal information is used, and the data processor handles that information on the controller’s instructions. British Sign can act in either role – and sometimes both at once – depending on the situation.

If you are an individual customer

When you buy or use British Sign for yourself – or you enrol family or friends as a private individual – Lisia Digital Limited is the data controller for the personal information we collect and process for you through British Sign.

If a school or organisation enrols you

Where a school, college, academy, business or other organisation buys enrolments, chooses which learners to enrol, supplies their details, decides how the course is used and monitors those learners through the enrolment dashboard, the organisation is the data controller for that learner information and for those decisions. In delivering the course, learner accounts, progress tracking and enrolment-management tools, Lisia Digital Limited acts as a data processor on the organisation’s behalf – processing learner information to provide the service the organisation has purchased, and following its instructions.

Even for an organisational booking, Lisia Digital Limited is also a data controller in its own right for the processing where we – not the organisation – decide the purpose and the means. This includes:

• our customer and billing records, and the legal and accounting obligations attached to them;
• security, fraud prevention and technical logs, such as access timestamps and IP addresses;
• handling support enquiries;
• the general administration needed to run British Sign; and
• the minimum certificate record we keep so a certificate can be verified, where we decide to retain and use it for that purpose.

So an organisational booking usually involves both roles at the same time: we are the organisation’s processor for delivering the course, and a controller in our own right for the records above.

Data processing terms for organisations

Where we process learner information on behalf of a school or organisation, our Data Processing Terms form part of our agreement with that organisation. These terms set out the controller and processor obligations required by the Data Protection (Bailiwick of Guernsey) Law, 2017, including our obligations on confidentiality, security, acting on the organisation’s instructions, sub-processors, learners’ data-protection rights, and the return or deletion of personal data. They apply to every organisational booking, so an organisation does not need to ask for them separately.

An organisation that needs a separately signed copy of these terms for its records can email support@british-sign.co.uk.

What we collect, and why

When you buy an enrolment

We collect the billing details we need to process your order: your name, postal address, email address, and (optionally) a telephone number. This information is needed to fulfil the contract of sale, issue a VAT-compliant invoice and contact you about your order.

When you (or someone you’ve enrolled) start the course

For each learner account we collect a first name, last name and email address. While the course is being used, the platform also records:

• Username and securely-hashed password
• Assessment scores and section progress
• Completion records and the data needed to issue your certificate
• Access timestamps and IP addresses (for security and support)

These records are used for course delivery, progress tracking, support and security, and – if you ask us for one – to prepare a Duke of Edinburgh’s Award assessor report, described next.

If you request a DofE assessor report

If you use the course for the Skills section of a Duke of Edinburgh’s Award and ask us for an assessor report, we use your course activity to prepare it:

• What we use – the weeks you have studied, your lesson scores and your access logs, together with your name.
• Who receives it – we prepare the report and submit it to eDofE, the Duke of Edinburgh’s Award’s official system, on your behalf. Your DofE Leader reviews it there.
• Lawful basis – consent. We prepare the report only when you ask us to, and you can withdraw that request at any time before we submit it.
• How long we keep it – we keep the report and the records used to prepare it for six years, in line with our billing records, so we can evidence a submission if it is ever queried.

When you visit the public website

We use Google Analytics on the public pages of british-sign.co.uk to understand which content is useful and where to improve. We do not run Google Analytics inside the learner course area. We also use functional cookies to remember your preferences (such as cookie-consent choices). You can review or change your cookie choices at any time on the Cookies Policy page.

Children and younger learners

The course may be used by under-18s, but a child is always enrolled by a responsible adult – a parent, guardian, teacher or other adult, or a school or organisation acting through a member of staff – who sets up and manages the enrolment and accepts our terms on the child’s behalf. We do not knowingly take enrolments, or collect a child’s details, directly from a child.

• Who creates the account – the adult or organisation holding the enrolment enters the learner’s first name, last name and email address on the enrolment dashboard.
• Who can see their progress – only the account holder, and only the learner’s username, email address, assessment scores and completion status – never the learner’s password or detailed activity logs.
• Logins and course emails – the account holder sends or resends each learner their username and login from the enrolment dashboard; emails about the enrolment itself (such as the dashboard link) go to the account holder.
• Who can exercise data rights – the responsible adult, or a parent or guardian on the child’s behalf, can ask us to access, correct, export or delete the learner’s personal data by emailing support@british-sign.co.uk. Where a school or other organisation holds the account, it is the data controller for that learner information (see “Our role”), so we may ask it to confirm or handle the request.
• DofE reports – if a report is requested for a younger participant, their course activity is handled as described in “If you request a DofE assessor report” above.
• Certificate verification – the learner’s name appears in the minimum certificate record we keep, so a certificate issued in their name can be verified. That record holds only the name, certificate number, completion date, course and version, and verification status.

Who we share data with

We do not sell personal data and we do not share it with third parties for marketing purposes. The following operational providers process limited data on our behalf so we can run the service:

• Krystal Hosting – UK-based VPS hosting for the website, learner platform and associated databases.
• Cloudflare – website security and traffic proxying.
• SendGrid – delivery of transactional emails such as login details, password resets and course notifications.
• Revolut Payments – payment processing for card transactions.
• Microsoft 365 – handling support enquiries received by email.
• Crisp – the chat widget you see at the bottom of each page.
• Google Analytics – website usage analytics on the public website only.

These providers process only the data they need for their part of the service. Where a provider processes personal data on our behalf, data-protection law requires appropriate written terms to be in place, and we use providers that offer such terms and suitable security. Where we act as a data processor for a school or organisation (see “Our role”), providers that process learner information on our behalf may act as our sub-processors. Our Data Processing Terms identify those providers and explain the arrangements that apply to them. Other providers, such as payment processing and public-website analytics, relate to processing we carry out as a controller in our own right.

How we keep your data safe

The learner platform is hosted on a UK-based VPS at Krystal Hosting, protected by:

• HTTPS encryption across the website and learner platform
• Two-factor authentication on administrative access to hosting
• Strictly limited administrative access to learner data
• Regular software and security updates
• Server-level and application-level security monitoring
• Multiple backups taken every day

The enrolment dashboard works the same way for everyone, whether you have enrolled yourself, a family member, a class or a whole team. Each account holder can see only the learners on their own account. From the dashboard you can view usernames, email addresses, assessment scores and completion status, but cannot access learner passwords or detailed activity logs.

How long we keep your data

Course access lasts two years from your first login, and we keep your learner account and progress record for that period so you can return to any section.

Where you are our own customer (we are the controller), we retain your learner account and learning records after your course access ends so that we can maintain your learning history, support account renewal and verify course completion. You can ask us to delete your personal data at any time, subject to information we need to retain for legal, accounting, security or certificate-verification purposes.

Where a school or organisation is the controller, how long a learner’s information is kept, and when it is deleted or returned, is governed by the processor terms and the organisation’s instructions, rather than by the individual arrangement above. The minimum certificate record is the one exception we keep in our own right.

That minimum certificate record contains only: the learner’s name, the certificate number, the completion date, the course and version, and the verification status. We keep it so that a certificate issued in a learner’s name can be confirmed as genuine; our lawful basis for this is our legitimate interest, and that of anyone relying on the certificate, in being able to verify it.

We keep billing and accounting records for as long as the tax and company-law rules that apply to us require – this includes keeping VAT records for the period required by our UK VAT registration, and accounting records for the period required under Guernsey company law.

Your data-protection rights

Lisia Digital Limited is established in Guernsey and processes personal data primarily under the Data Protection (Bailiwick of Guernsey) Law, 2017. UK data-protection law (the UK GDPR and Data Protection Act 2018) may also apply in some circumstances.

You have the right to:

• Be informed about how we use your data (this page)
• Access the personal data we hold about you
• Correct anything inaccurate or incomplete
• Have your data erased, subject to the limits described above
• Restrict or object to certain types of processing
• Receive a portable copy of the data you’ve provided to us
• Not be subject to a decision based solely on automated processing (we don’t do any)

Who to contact depends on our role. If a school or organisation enrolled you, that organisation is the data controller for your learner information, so requests about it should usually go to them; if you contact us, we will help them respond. For individual customers, and for the records we hold as a controller in our own right (see “Our role”), contact us directly.

To exercise any of these rights, email support@british-sign.co.uk and we’ll respond within one month, the period allowed under the Data Protection (Bailiwick of Guernsey) Law, 2017.

Complaints

We hope to resolve any concern directly. If you are unhappy with how we have handled your personal data, you can complain to the Office of the Data Protection Authority (ODPA) in Guernsey, at odpa.gg. Where UK data-protection law applies, you may also have the right to complain to the UK Information Commissioner’s Office (ICO), at ico.org.uk.

Changes to this policy

We may update this page from time to time. The “last updated” date at the top always shows the current version. If we make a change that materially affects how we use your personal data, we will take appropriate steps to bring it to the attention of affected learners.

Contact

• Email support@british-sign.co.uk
• Use the chat widget at the bottom of any page
• Visit our contact page for postal address and other options