1. Who we are

Licensing School is a trading name of Waken Limited. For the activities described in this policy, Waken Limited is normally the controller of your personal data. This means that we decide why and how your personal data is used.

This policy applies to visitors to our websites, customers, prospective customers, learners, event and webinar attendees, newsletter subscribers, business contacts, suppliers and people who contact us. It covers our websites, online shop, training services, events, communications and related business systems.

Controller details Waken Limited trading as Licensing School Company number: 05101297 Registered office and principal place of business: 3 Maultway Close, Camberley, Surrey GU15 1PP Privacy contact: paul@licensingschool.co.uk | +44 (0)7801 881419

Where we process personal data only on a customer’s documented instructions, for example in connection with a hosted service supplied to an organisational customer, we may act as a processor. The relevant contract or data processing agreement will govern that processing. This policy principally explains our activities as controller.

2. Scope and important terms

“Personal data” means information relating to an identified or identifiable person. “Processing” includes collecting, recording, organising, using, sharing, storing and deleting personal data. “Special category data” includes information about health, race or ethnicity, political opinions, religion, trade union membership, genetics, biometrics and sex life or sexual orientation.

This policy is intended to meet the transparency requirements of the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR), and relevant changes made by the Data (Use and Access) Act 2025.

3. The personal data we collect

Category	Examples	Typical source
Identity and contact data	Name, job title, employer, postal address, email address, telephone number and account identifiers.	You, your employer, an event organiser, a reseller or a publicly available business source.
Account and service data	Login details, subscription or entitlement information, course enrolment, attendance, progress, support history and service preferences.	You, your employer and our service platforms.
Transaction data	Products or services purchased, order value, invoice, payment status, refunds and related correspondence. We do not normally receive full payment-card details.	You, your employer and payment providers such as PayPal or Stripe.
Communications and enquiry data	Messages, contact-form submissions, call or meeting notes, survey responses, complaints and support correspondence.	You and people communicating on your behalf.
Marketing and preference data	Newsletter subscriptions, consent records, opt-outs, campaign interactions and preferences.	You and our marketing systems.
Technical and usage data	IP address, device and browser information, approximate location, referral source, pages viewed, session activity, timestamps and cookie identifiers.	Your device, website technologies and analytics providers.
Content and interaction data	Questions, prompts, feedback, files or other content you submit when using training, support or interactive services, together with related timestamps and usage records.	You, your employer and our service systems.
Publication data	Testimonials, comments, event photographs or other material you agree or ask us to publish.	You or an event organiser.
Compliance data	Records needed to demonstrate consent, fulfil rights requests, investigate security incidents, prevent misuse or comply with law.	You, our systems, advisers and relevant authorities.

4. How and why we use personal data

We use personal data only where we have a lawful basis. We do not rely on consent where another lawful basis is more appropriate. Where we rely on legitimate interests, we consider the purpose, necessity and impact on individuals and keep an appropriate record of that assessment.

Purpose	Data typically used	Lawful basis
Provide accounts, training, subscriptions, events and support	Identity and contact; account and service; communications; content and interaction	Contract; legitimate interests in administering services and supporting organisational customers
Process orders, invoices, payments and refunds	Identity and contact; transaction; communications	Contract; legal obligation; legitimate interests in financial administration
Operate, secure and improve websites and services	Technical and usage; account and service; content and interaction; compliance	Legitimate interests in service operation, security, fraud prevention and improvement; consent where required for non-essential cookies
Respond to enquiries and manage customer relationships	Identity and contact; communications; customer relationship data	Steps requested before contract; contract; legitimate interests in responding and managing business relationships
Send service messages	Identity and contact; account and service	Contract; legitimate interests in keeping users informed about service, security or operational matters
Send newsletters and direct marketing	Identity and contact; marketing and preference; campaign interaction	Consent where PECR requires it; otherwise legitimate interests where lawful, including relevant business-to-business marketing
Run webinars, events and promotions	Identity and contact; account and service; publication data	Contract; legitimate interests; consent for optional publicity or marketing where required
Keep records and protect legal rights	Transaction; communications; compliance data	Legal obligation; legitimate interests in establishing, exercising or defending legal claims
Meet regulatory, tax and law-enforcement obligations	Identity and contact; transaction; communications; compliance	Legal obligation; public task where applicable
Publish testimonials or identifiable promotional material	Publication data	Consent, or legitimate interests where we have appropriately balanced the interests involved

5. Direct marketing

We may send information about Licensing School products, services, courses, webinars and events where the law permits. For individual subscribers, we generally rely on consent unless the PECR “soft opt-in” applies to marketing about our similar products or services. For corporate business contacts, we may rely on legitimate interests where PECR permits business-to-business marketing.

• Every marketing email will provide a clear way to unsubscribe.
• You can change your preferences or object to direct marketing at any time by contacting us.
• We maintain a suppression record after an opt-out so that we can respect your choice.
• We do not sell personal data or provide mailing lists to third parties for their independent marketing.

Opting out of marketing will not prevent us from sending necessary service, account, contractual or security communications.

6. Cookies and similar technologies

Cookies are small files placed on a device. Some cookies are essential for website operation. Others support preferences, analytics or marketing. We will not set non-essential cookies unless we have obtained the consent required by PECR. You can withdraw or change that consent through the cookie settings available on our website.

Type	Purpose	Basis
Strictly necessary	Security, login, shopping basket, checkout and core website operation.	No consent required where the exemption applies.
Preferences	Remember choices and improve convenience.	Consent, unless strictly necessary for a service you requested.
Analytics	Understand website use and performance, for example through Google Analytics.	Consent.
Marketing	Measure campaigns or personalise marketing where used.	Consent.

Our current cookie banner or cookie notice should be read with this policy because it identifies the specific cookies in use, their providers and their durations. Browser controls can also block or delete cookies, but doing so may affect website functionality.

7. Sharing personal data

We share personal data only where necessary, proportionate and lawful. Recipients may include:

• website, hosting, content-delivery, security, backup and IT support providers;
• learning, webinar, video, membership, customer relationship management and support platforms;
• email and marketing providers, including Mailchimp;
• website and analytics providers, including WordPress, WooCommerce and Google Analytics where enabled;
• payment providers, including PayPal and Stripe;
• accountants, auditors, insurers, banks, lawyers and other professional advisers;
• resellers, event partners or a customer’s employer where this is necessary to deliver the contracted service and individuals have been appropriately informed;
• law-enforcement bodies, courts, regulators, tax authorities or other parties where disclosure is required or permitted by law; and
• a buyer, seller or adviser involved in a genuine or proposed business reorganisation, subject to appropriate confidentiality and data-protection safeguards.

Service providers acting as processors must use personal data only on our instructions, keep it secure and assist us with applicable data-protection obligations. Some recipients act as independent controllers and provide their own privacy information.

8. International transfers

Some suppliers may process personal data outside the United Kingdom. Where the recipient’s country is not covered by UK adequacy regulations, we use an appropriate safeguard such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another lawful transfer mechanism. Where required, we carry out a transfer risk assessment and apply supplementary technical or contractual measures.

For transfers to organisations participating in an applicable UK extension to a recognised data-privacy framework, we verify the recipient’s certification and the scope of coverage. You may contact us for further information about the safeguards relevant to your data, subject to protection of confidential information.

9. Retention and deletion

We keep personal data only for as long as needed for the purpose for which it was collected, including legal, accounting, tax, security and dispute-resolution requirements. We consider the amount, nature and sensitivity of the data, the risk of harm, the purpose and whether that purpose can be achieved in another way.

Record	Indicative retention period
Prospect enquiries and sales records	Normally up to 24 months after the last meaningful interaction, unless there is an ongoing relationship, objection or legal reason to keep them.
Customer account, contract and service records	For the relationship and normally up to 6 years afterwards, reflecting limitation periods for contractual claims.
Invoices, payments and tax records	Normally 6 years after the end of the relevant accounting period, or longer where law requires.
Training, attendance and entitlement records	For the service term and normally up to 6 years afterwards where needed to evidence delivery, certification, entitlement or contractual compliance.
Marketing records	Until consent is withdrawn, an objection is made or the data is no longer needed. We periodically review inactive contacts.
Suppression records	As long as reasonably necessary to ensure that an opt-out continues to be respected.
Website analytics and cookie identifiers	According to the periods stated in the live cookie notice and provider settings; these should be configured to the shortest period reasonably required.
Support and routine correspondence	Normally up to 3 years after closure, unless linked to a contract, complaint or legal claim.
Security logs and incident records	Normally 12 to 24 months for logs, and up to 6 years for material incident records, depending on risk and legal requirements.
Rights requests and complaints	Normally 6 years after closure to demonstrate compliance and manage potential claims.

These are standard periods, not absolute rules. We may keep data for a shorter or longer period where justified, for example because of a live dispute, legal hold, safeguarding concern, regulatory investigation or a customer’s documented requirement. At the end of the period, data is deleted, anonymised or securely archived with restricted access.

10. Security

We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Measures are selected according to risk and may include access controls, multi-factor authentication, encryption in transit, secure configuration, backups, logging, staff confidentiality, supplier due diligence, incident management and periodic review.

No internet transmission or storage system is completely secure. If you believe that personal data or an account has been compromised, contact us promptly using the details in section 17.

11. Personal data breaches

We assess suspected personal data breaches promptly. Where required, we notify the Information Commissioner’s Office without undue delay and, where feasible, within 72 hours after becoming aware of the breach. Where a breach is likely to result in a high risk to individuals, we will also inform affected individuals without undue delay, unless an applicable exception applies.

12. Your data-protection rights

Depending on the circumstances, you may have the following rights:

Right	What it means
Access	Obtain confirmation that we process your data and receive a copy with required supplementary information.
Rectification	Have inaccurate personal data corrected and incomplete data completed.
Erasure	Ask us to delete personal data where a legal ground applies.
Restriction	Ask us to restrict processing in specified circumstances.
Objection	Object to processing based on legitimate interests or public task. You have an absolute right to object to direct marketing.
Portability	Receive certain data you provided in a structured, commonly used, machine-readable format and transmit it to another controller.
Withdraw consent	Withdraw consent at any time, without affecting processing before withdrawal.
Automated decisions	Receive safeguards and challenge a significant decision made solely by automated processing where the law provides this right.
Complain	Raise a concern with us and lodge a complaint with the Information Commissioner’s Office.

You can exercise your rights by contacting us. We may request information needed to confirm identity and authority. We normally respond without undue delay and within one month. The law permits an extension in certain circumstances; if we extend the time or do not act on a request, we will explain why and tell you about complaint rights. Rights are not absolute and exemptions may apply.

13. Complaints

Please contact us first so that we can investigate and try to resolve your concern. We acknowledge data-protection complaints and handle them through an appropriate process, keeping you informed of the outcome.

You may also complain to the Information Commissioner’s Office (ICO): ico.org.uk/make-a-complaint | Telephone: 0303 123 1113. If you are outside the UK, you may also have the right to contact the data-protection authority in the place where you live or work.

14. Automated decision-making and artificial intelligence

We do not currently make decisions about individuals that produce legal or similarly significant effects solely by automated means as part of the activities covered by this policy. If this changes, we will provide meaningful information about the logic involved, the significance and likely consequences, and the safeguards available, as required by law.

Where an interactive or AI-enabled service accepts user-submitted questions, prompts or content, we process that information to provide the service, maintain security, troubleshoot, monitor performance and improve the service where permitted. Customers and users should not submit special category data, confidential third-party information or personal data that is unnecessary for their request. Any materially different use, including model training with identifiable customer content, requires a clear lawful basis and appropriate notice or agreement.

15. Children

Our services are primarily intended for business users and adults. We do not knowingly collect personal data from children through our general website or marketing activities. If a service is offered to a child, we will provide age-appropriate information and obtain parental authorisation where required. If you believe a child has provided personal data to us inappropriately, contact us so that we can investigate and take appropriate action.

16. Third-party websites and services

Our websites may link to third-party websites or services. Those organisations determine their own processing and privacy practices. We are not responsible for their privacy notices, and you should review them before providing personal data.

17. Contact us

Waken Limited trading as Licensing School
3 Maultway Close
Camberley
Surrey GU15 1PP

Privacy lead: Paul Burgum
Email: paul@licensingschool.co.uk
Telephone: +44 (0)7801 881419

General enquiries may also be sent through the contact form or contact details published on our website.

18. Changes to this policy

We review this policy regularly and update it when our processing, suppliers or the law changes. The latest version will be published on our website with its effective date. If a change is material, we will take reasonable steps to draw it to the attention of affected individuals before the change takes effect where appropriate.

19. Document control

Document owner	Privacy lead
Approved by	Waken Limited management
Effective date	3 November 2026
Next scheduled review	November 2027, or earlier if processing or law changes