Legal
Privacy policy
Last updated: October 2026
1. Who is responsible for your data
Tim Young, trading as Young Procurement, is the data controller for publicsectorprocurementacademy.co.uk. Contact: enquiries@publicsectorprocurementacademy.co.uk, 138 Proctor Road, Norwich, NR6 7PH.
2. What we collect and why
| Data | Why | Lawful basis |
|---|---|---|
| Name and email address | To create and run your account, and send account and purchase emails | Contract |
| Password | To let you sign in. Stored only as a secure hash, never in readable form. | Contract |
| Course purchases | To give you access to what you bought, and for our accounting records | Contract; legal obligation |
| Course progress (screens completed, test scores and decisions, notes and written work you type into a course, the name you enter for your certificate) | To save your progress across devices and issue your certificate | Contract |
| Certificate record (name, course, completion date, final score, certificate ID) | So anyone holding your certificate ID can verify it | Contract; legitimate interests |
| Marketing preference | To email you about new courses, only if you opted in | Consent |
| Basic server logs | To keep the site secure and fix problems | Legitimate interests |
Payment card details are handled entirely by Stripe. We never see or store them.
3. Certificate verification is public by design
Anyone who enters your certificate ID on our verification page can see the name on the certificate, the course, the completion date and your final assessment score. They can't search by name or browse certificates. Share your certificate ID only with people you want to be able to check it.
4. Who we share data with
- Stripe: payment processing.
- Resend: sending account and purchase emails.
- Railway: hosting the website and database.
We don't sell your data or share it for anyone else's marketing.
Free courses
Free courses, such as Inside a Public Tender, need no account. The name you enter and your progress are saved only in your own browser. We don't receive or store them.
5. What you write in a course
Answers you type into course exercises are saved with your course progress so you can carry on from another device. Don't enter real supplier, contract or personal data into exercises: they are designed for the fictional scenarios provided.
6. How long we keep data
We keep your account for as long as it's open. If you ask us to delete it, we remove your personal data within 30 days, except transaction records we must keep for tax purposes and certificate records needed to answer verification checks (unless you ask us to withdraw your certificate too).
7. Cookies
We use one essential cookie to keep you signed in. Courses also use your browser's local storage to save your progress on the device. We don't use advertising or tracking cookies, and the site loads no third-party analytics or fonts.
8. Your rights
Under UK GDPR you can ask for a copy of your data, ask us to correct or delete it, object to or restrict some uses, and withdraw consent to marketing at any time. You can also complain to the Information Commissioner's Office (ico.org.uk).