Privacy Policy

Last updated: 18 July 2026

SJA Global Academia respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect and use personal data when you visit https://sjaacademia.co.uk, make an enquiry, create an account, buy or enrol on a course, use our learning services, or otherwise communicate with us.

This notice is written to support compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, where relevant, the Privacy and Electronic Communications Regulations 2003 (PECR).

1. Who we are

SJA GLOBAL ACADEMIA LTD, trading as SJA Global Academia, is the controller responsible for the personal data described in this policy.

• Website: https://sjaacademia.co.uk
• Email: info@sjaacademia.co.uk
• Telephone: +44 (0)20 3432 3249
• Contact address: Office 14882, 182–184 High Street North, East Ham, London, E6 2JA, United Kingdom
• Company number: 16768804
• ICO registration number: ZC008811

2. Scope of this policy

This policy applies to personal data processed through our website, enquiry and consultation forms, WooCommerce checkout, learner accounts, learning management systems, teaching and assessment services, qualification administration, customer support and relevant professional services.

Where another organisation independently decides how and why your data is used—for example, an awarding organisation, university, payment provider or partner institution—that organisation may also be a separate controller and should provide its own privacy notice.

3. Personal data we collect

Depending on your relationship with us, we may collect:

• Identity data: name, title, date of birth where required, username, learner or candidate number, and identity-verification information.
• Contact data: email address, telephone number, postal and billing address, country of residence and preferred contact method.
• Enquiry and professional data: organisation, requested service, existing qualifications, career or progression goals, messages and consultation notes.
• Account and enrolment data: login details, course selections, enrolment information, support requests, preferences and account history.
• Transaction data: purchases, payments, instalments, invoices, refunds, cancellations and chargeback information. We do not normally receive complete payment-card details from the payment provider.
• Learning and assessment data: attendance or engagement, course progress, submitted work, assessment decisions, tutor feedback, internal quality assurance records, reasonable-adjustment information, certificates and recognition of prior learning evidence.
• Communications data: emails, form submissions, telephone or messaging records and correspondence about complaints or support.
• Technical and usage data: IP address, device and browser information, time zone, login records, pages viewed, referral information, security logs and cookie identifiers.
• Marketing data: subscription status, communication preferences and engagement with marketing messages.

Please do not provide more personal data than is necessary. Where identity documents are requested, we will explain why they are needed and how they should be submitted securely.

4. How we obtain personal data

We collect data:

• directly from you when you browse, enquire, register, purchase, enrol, submit learning evidence, request support or communicate with us;
• automatically through essential website technologies and, with consent where required, analytics or advertising cookies;
• from payment, hosting, learning-platform, communications and technical-service providers;
• from employers, sponsors, awarding organisations, assessors, education partners or progression partners where this is necessary and lawful; and
• from publicly available or professional sources where relevant to a business enquiry and permitted by law.

If you give us information about another person, you must have authority to do so and should direct them to this policy.

5. How and why we use personal data

We will not use personal data for a materially incompatible purpose without explaining the change and identifying a valid lawful basis.

6. When information is required

Some information is needed to enter into or perform a contract, meet awarding-organisation requirements, verify identity, process payment or comply with law. If required information is not provided, we may be unable to enrol you, deliver a service, process a certificate or respond fully to your request. We will identify mandatory fields where practical.

7. Special-category data

Information about health, disability, ethnicity, religion or certain other characteristics receives additional legal protection. We may process relevant health, disability or learning-support information to consider reasonable adjustments, accessibility or learner support.

We will identify both an Article 6 lawful basis and an Article 9 condition before processing special-category data. Depending on the circumstances, this may include your explicit consent or another condition permitted by law. Where we rely on explicit consent, you may withdraw it, although this will not affect processing already carried out lawfully. We will not collect special-category data merely because it may be useful.

We do not intentionally collect criminal-offence data unless it is necessary, lawful and supported by an appropriate condition under the Data Protection Act 2018.

8. Sharing personal data

We may disclose relevant data to:

• tutors, assessors, internal quality assurers and authorised staff;
• awarding organisations, external quality assurers, certification bodies, universities, education partners or progression partners where relevant;
• website hosts, learning-platform providers, customer-management systems, form providers, email and communications services, file-storage services and IT/security support;
• payment processors, banks, instalment providers and fraud-prevention services, including Stripe and PayPal;
• accountants, auditors, insurers, lawyers and other professional advisers;
• regulators, courts, law-enforcement agencies, tax authorities or public bodies where required or permitted by law; and
• a purchaser, investor or successor in connection with a genuine business reorganisation, subject to appropriate confidentiality and legal safeguards.

The providers and platforms we use may include Hostinger for website hosting; WordPress and WooCommerce for website, account and ecommerce functionality; Moodle for learning delivery and learner records; Fluent Forms for website forms; Google Analytics for website measurement where cookie consent has been obtained; Stripe and PayPal for payments; an email-marketing and email-delivery provider; and WhatsApp or another messaging service when you choose to communicate with us through those channels. We also share relevant learner information with Focus Awards and, where applicable, university or other education partners for qualification administration, certification, quality assurance or progression enquiries.

Providers may change from time to time. We periodically review the services we use and require appropriate data-protection terms where they act as our processors. Some providers and education partners act as independent controllers and supply their own privacy information.

Service providers acting as processors may use personal data only on our documented instructions and must protect it appropriately. Some recipients, such as awarding organisations, universities and payment providers, may act as independent controllers.

We do not sell personal data.

9. International data transfers

Some suppliers or education partners may process personal data outside the United Kingdom. Before making a restricted transfer, we will use a lawful transfer mechanism where required. This may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another legally permitted safeguard. We will also carry out any required transfer risk assessment.

You may contact us for information about the relevant safeguard. Before publication, verify the locations and transfer mechanisms used by each supplier and partner.

10. Data retention

We retain personal data only for as long as needed for the purpose for which it was collected and to meet legal, tax, accounting, awarding-organisation, audit, complaint and dispute requirements. Our indicative periods are:

• unsuccessful or inactive enquiries: normally up to 24 months after the last meaningful contact;
• customer, contract, order and core learner-administration records: normally six years after the relationship or contract ends;
• accounting and transaction records: normally six years after the end of the relevant financial year, subject to legal advice and applicable requirements;
• assessment, quality-assurance and certification records: for the period required by the relevant awarding organisation and our approved retention schedule;
• identity documents: normally up to three years after collection where this is required for identity verification, awarding-organisation audit or compliance purposes; where the document itself is no longer required, we will delete it earlier and may retain a limited verification record instead;
• unsuccessful complaints or disputes: for the period necessary to resolve the matter and address potential legal claims;
• marketing records: until consent is withdrawn or you object, with a minimal suppression record retained to respect your preference; and
• cookie information: for the periods stated in our Cookie Policy and consent tool.

We may retain data for longer where litigation, a regulatory enquiry, safeguarding concern or legal hold reasonably requires it. When data is no longer required, we securely delete or irreversibly anonymise it.

These periods must be checked against SJA’s documented retention schedule and every awarding or partner organisation’s rules before publication.

11. Data security

We use proportionate technical and organisational measures designed to protect personal data against accidental or unlawful loss, alteration, disclosure, access or destruction. Measures may include access controls, staff confidentiality, secure authentication, backups, system updates, processor due diligence and incident-management procedures.

No internet service is completely secure. You are responsible for keeping account credentials confidential and should contact us promptly if you suspect unauthorised access.

12. Your data-protection rights

Depending on the circumstances and lawful basis, you may have the right to:

• be informed about how your data is used;
• access your personal data;
• correct inaccurate or incomplete data;
• request erasure;
• restrict processing;
• object to processing based on legitimate interests;
• object at any time to direct marketing;
• receive certain data in a portable format and transmit it to another controller;
• withdraw consent at any time where processing relies on consent; and
• ask for safeguards relating to certain automated decisions.

These rights are not absolute and exemptions may apply. We may request information to verify your identity. We normally respond without undue delay and within one month, although UK data-protection law allows an extension in certain cases.

To exercise a right, email info@sjaacademia.co.uk with the subject line “Data protection request”. You will not normally have to pay a fee.

13. Automated decision-making

We do not currently make decisions producing legal or similarly significant effects about you solely by automated means. If this changes, we will provide the information and safeguards required by law before the processing begins.

14. Marketing communications

We may send marketing where you have consented or where another lawful route under PECR permits it. Consent to marketing is optional and is not a condition of buying a course or receiving a service.

You may unsubscribe using the link in an email or by contacting info@sjaacademia.co.uk. We may retain a minimal suppression record to ensure we honour your request. Opting out of marketing does not stop necessary account, order, enrolment, security or service communications.

15. Cookies and similar technologies

We use necessary cookies to operate and secure the website. We will ask for consent before setting or accessing non-essential cookies unless an exemption applies. Rejecting optional cookies must be as easy as accepting them, and you must be able to change your choice later.

Our separate Cookie Policy should identify each cookie or technology, its provider, purpose, duration and category, and explain how to manage consent. The live cookie banner and policy must reflect the technologies actually deployed on the website.

16. Children

Our courses and online learning services are intended for people aged 18 or over. We do not knowingly enrol children or collect their personal data for course delivery. If we learn that a person under 18 has submitted personal data without an appropriate lawful reason, we will take reasonable steps to delete it.

If you believe a child has submitted data inappropriately, contact us promptly.

17. Complaints

Please contact us first if you have concerns so that we can try to resolve them.

You also have the right to complain to the UK supervisory authority:

Information Commissioner’s Office (ICO)
Website: https://ico.org.uk/make-a-complaint/
Telephone: 0303 123 1113
Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

If you live outside the UK, you may also have the right to complain to your local data-protection authority.

18. Third-party websites

Our website may link to external websites or services. Their privacy practices are controlled by their own notices, and we are not responsible for their content or handling of personal data. Review the relevant notice before providing information.

19. Changes to this policy

We may update this policy to reflect changes in law, services or technology. We will publish the revised version and update the date above. If a change materially affects how we use existing personal data, we will provide additional notice where required.

20. Contact us

For questions, requests or complaints about personal data, contact:

Privacy Lead / Data Protection Contact
SJA GLOBAL ACADEMIA LTD t/a SJA Global Academia
Email: info@sjaacademia.co.uk
Telephone: +44 (0)20 3432 3249
Address: Office 14882, 182–184 High Street North, East Ham, London, E6 2JA, United Kingdom
Company number: 16768804
ICO registration number: ZC008811